Feature 19: Notifications - Web Push and Google Chat (#169)

Co-authored-by: orchestrator-agent <20+orchestrator-agent@code.cubecraftcreations.com>

internal/chat/chat.go

@@ -0,0 +1,519 @@
+// Package chat sends notifications to the household's Google Chat space
+// through its incoming webhook, and keeps that webhook in chat_settings.
+//
+// The webhook URL carries its own key and token, so it is a secret: it is
+// sealed with secretbox in webhook_url_ct and is never returned, logged or
+// put in an error. Only its space label, a masked tail and the outcome of
+// the last test message are shown.
+package chat
+
+import (
+	"bytes"
+	"context"
+	"database/sql"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+	"unicode/utf8"
+
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/db"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/household"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/jobs"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/notify"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/secretbox"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/store"
+)
+
+const (
+	// MaxSpaceLabelChars bounds a space label.
+	MaxSpaceLabelChars = 100
+	// requestTimeout bounds one post to Google Chat.
+	requestTimeout = 15 * time.Second
+	// maxDrainBytes bounds how much of a Google Chat response is read.
+	maxDrainBytes = 4096
+	// replyOption threads a message under its threadKey, starting the
+	// thread when there is none yet.
+	replyOption = "REPLY_MESSAGE_FALLBACK_TO_NEW_THREAD"
+)
+
+// Test outcomes, as chat_settings.last_test_status stores them.
+const (
+	TestOK     = "ok"
+	TestFailed = "failed"
+)
+
+var (
+	// ErrNotConfigured is returned when no webhook is stored.
+	ErrNotConfigured = errors.New("chat: no Google Chat webhook is configured")
+	// ErrUnreachable is wrapped by the error of a post Google Chat did not
+	// answer.
+	ErrUnreachable = errors.New("chat: Google Chat did not answer")
+	// ErrRefused is matched by the *RefusedError of a post Google Chat
+	// answered with a status other than 2xx.
+	ErrRefused = errors.New("chat: Google Chat refused the message")
+	// ErrWebhookChanged is returned by Test when the webhook was replaced
+	// while the test message was being sent; nothing is recorded.
+	ErrWebhookChanged = errors.New("chat: the Google Chat webhook changed during the test")
+)
+
+// Settings is the stored webhook as the API shows it: never the URL, only
+// its masked form. URLMasked is nil when no webhook is stored.
+type Settings struct {
+	SpaceLabel *string `json:"space_label"`
+	// URLMasked is the webhook URL without its key and with only the last
+	// few characters of its token.
+	URLMasked *string `json:"url_masked"`
+	// LastTestAt and LastTestStatus ("ok" or "failed") are nil until a
+	// test message is sent to this webhook.
+	LastTestAt     *string `json:"last_test_at"`
+	LastTestStatus *string `json:"last_test_status"`
+}
+
+// TestResult is the outcome of a test message.
+type TestResult struct {
+	// HTTPStatus is the status Google Chat answered.
+	HTTPStatus int `json:"http_status"`
+	Settings
+}
+
+// RefusedError is a post Google Chat answered with Status, not 2xx. It
+// matches ErrRefused.
+type RefusedError struct {
+	Status int
+}
+
+func (e *RefusedError) Error() string {
+	return fmt.Sprintf("%v with status %d", ErrRefused, e.Status)
+}
+
+func (e *RefusedError) Unwrap() error { return ErrRefused }
+
+// Retryable reports whether posting again may succeed: Google Chat was
+// busy (429) or failing (5xx), rather than refusing the message.
+func (e *RefusedError) Retryable() bool {
+	return e.Status == http.StatusTooManyRequests || e.Status >= 500
+}
+
+// Problem is one invalid field of a webhook update, named by its JSON key.
+type Problem struct {
+	Field  string
+	Reason string
+}
+
+// ValidationError lists every problem with a webhook update. It never
+// quotes the URL.
+type ValidationError struct {
+	Problems []Problem
+}
+
+func (e *ValidationError) Error() string {
+	parts := make([]string, len(e.Problems))
+	for i, p := range e.Problems {
+		parts[i] = p.Field + ": " + p.Reason
+	}
+	return "invalid Google Chat webhook: " + strings.Join(parts, "; ")
+}
+
+// Service keeps the webhook and posts to it. It is the notify.Sender of the
+// chat channel.
+type Service struct {
+	st  *store.Store
+	box *secretbox.Box
+	// publicURL is MEALQUEST_PUBLIC_URL, which a card's "Open" button
+	// links under.
+	publicURL *url.URL
+	client    *http.Client
+	// now is the clock settings are saved and tests recorded on; tests
+	// replace it.
+	now func() time.Time
+}
+
+// NewService returns the service over st, sealing the webhook with box and
+// linking cards under publicURL. Requests go through transport
+// (http.DefaultTransport in production) and never follow a redirect.
+func NewService(st *store.Store, box *secretbox.Box, publicURL *url.URL, transport http.RoundTripper) (*Service, error) {
+	switch {
+	case st == nil:
+		return nil, errors.New("chat: nil store")
+	case box == nil:
+		return nil, errors.New("chat: nil secret box")
+	case publicURL == nil:
+		return nil, errors.New("chat: nil public URL")
+	case transport == nil:
+		return nil, errors.New("chat: nil transport")
+	}
+	return &Service{
+		st:        st,
+		box:       box,
+		publicURL: publicURL,
+		client: &http.Client{
+			Transport: transport,
+			Timeout:   requestTimeout,
+			CheckRedirect: func(*http.Request, []*http.Request) error {
+				return http.ErrUseLastResponse
+			},
+		},
+		now: time.Now,
+	}, nil
+}
+
+// Get returns the stored webhook's settings; every field is nil before one
+// is saved.
+func (s *Service) Get(ctx context.Context) (Settings, error) {
+	row, err := db.New(s.st.Reader).GetChatSettings(ctx)
+	if errors.Is(err, sql.ErrNoRows) {
+		return Settings{}, nil
+	}
+	if err != nil {
+		return Settings{}, fmt.Errorf("chat: read chat settings: %w", err)
+	}
+	hook, err := s.open(row)
+	if err != nil {
+		return Settings{}, err
+	}
+	return settingsFrom(row, hook), nil
+}
+
+// Put validates rawURL and spaceLabel and stores them, replacing any
+// webhook stored before and clearing its test outcome. Every problem is
+// reported in a *ValidationError.
+func (s *Service) Put(ctx context.Context, rawURL, spaceLabel string) (Settings, error) {
+	var problems []Problem
+	hook, err := ParseWebhook(rawURL)
+	if err != nil {
+		problems = append(problems, Problem{"url", err.Error()})
+	}
+	label := strings.TrimSpace(spaceLabel)
+	switch {
+	case label == "":
+		problems = append(problems, Problem{"space_label", "is required"})
+	case utf8.RuneCountInString(label) > MaxSpaceLabelChars:
+		problems = append(problems, Problem{"space_label", fmt.Sprintf("must be at most %d characters", MaxSpaceLabelChars)})
+	case strings.ContainsFunc(label, func(r rune) bool { return r < ' ' || r == 0x7f }):
+		problems = append(problems, Problem{"space_label", "must not contain control characters"})
+	}
+	if len(problems) > 0 {
+		return Settings{}, &ValidationError{Problems: problems}
+	}
+	ct, err := s.box.Encrypt([]byte(hook.String()))
+	if err != nil {
+		return Settings{}, fmt.Errorf("chat: seal webhook: %w", err)
+	}
+
+	var saved db.ChatSetting
+	err = s.st.WithTx(ctx, func(tx *sql.Tx) error {
+		q := db.New(tx)
+		row, err := q.GetChatSettings(ctx)
+		if err != nil && !errors.Is(err, sql.ErrNoRows) {
+			return fmt.Errorf("chat: read chat settings: %w", err)
+		}
+		now := s.timestamp()
+		created := now
+		if err == nil {
+			created = row.CreatedAt
+		}
+		saved, err = q.UpsertChatSettings(ctx, db.UpsertChatSettingsParams{
+			WebhookUrlCt: ct,
+			SpaceLabel:   sql.NullString{String: label, Valid: true},
+			CreatedAt:    created,
+			UpdatedAt:    now,
+		})
+		if err != nil {
+			return fmt.Errorf("chat: save chat settings: %w", err)
+		}
+		return nil
+	})
+	if err != nil {
+		return Settings{}, err
+	}
+	return settingsFrom(saved, hook), nil
+}
+
+// Test posts TestText to the stored webhook, unthreaded, and records when
+// and whether Google Chat accepted it. A status Google Chat answers is a
+// TestResult, whatever it is; a request that gets no answer is recorded as
+// failed and returned as an error. A test cut short by ctx records nothing.
+func (s *Service) Test(ctx context.Context) (TestResult, error) {
+	row, err := db.New(s.st.Reader).GetChatSettings(ctx)
+	if errors.Is(err, sql.ErrNoRows) {
+		return TestResult{}, ErrNotConfigured
+	}
+	if err != nil {
+		return TestResult{}, fmt.Errorf("chat: read chat settings: %w", err)
+	}
+	hook, err := s.open(row)
+	if err != nil {
+		return TestResult{}, err
+	}
+	status, postErr := s.post(ctx, hook, message{Text: TestText}, "")
+	if err := ctx.Err(); err != nil {
+		return TestResult{}, err
+	}
+	outcome := TestFailed
+	if postErr == nil && status >= 200 && status < 300 {
+		outcome = TestOK
+	}
+	at := s.timestamp()
+	write, cancel := jobs.FinalWriteContext(ctx)
+	defer cancel()
+	n, err := db.New(s.st.Writer).RecordChatTest(write, db.RecordChatTestParams{
+		LastTestAt:     sql.NullString{String: at, Valid: true},
+		LastTestStatus: sql.NullString{String: outcome, Valid: true},
+		UpdatedAt:      at,
+		WebhookUrlCt:   row.WebhookUrlCt,
+	})
+	if err != nil {
+		return TestResult{}, fmt.Errorf("chat: record test: %w", err)
+	}
+	if n != 1 {
+		return TestResult{}, ErrWebhookChanged
+	}
+	if postErr != nil {
+		return TestResult{}, postErr
+	}
+	row.LastTestAt = sql.NullString{String: at, Valid: true}
+	row.LastTestStatus = sql.NullString{String: outcome, Valid: true}
+	row.UpdatedAt = at
+	return TestResult{HTTPStatus: status, Settings: settingsFrom(row, hook)}, nil
+}
+
+// Send posts m to the stored webhook, threaded by the week of its payload,
+// and is the chat channel's notify.Sender. Google Chat answering 2xx is
+// success; 429 or 5xx, or no answer at all, is an error the outbox
+// retries; any other status, or no webhook stored, wraps
+// notify.ErrUndeliverable so the row fails at once.
+func (s *Service) Send(ctx context.Context, m notify.Message) error {
+	row, err := db.New(s.st.Reader).GetChatSettings(ctx)
+	if errors.Is(err, sql.ErrNoRows) {
+		return fmt.Errorf("%w: %w", notify.ErrUndeliverable, ErrNotConfigured)
+	}
+	if err != nil {
+		return fmt.Errorf("chat: read chat settings: %w", err)
+	}
+	hook, err := s.open(row)
+	if err != nil {
+		return err
+	}
+	msg, err := s.messageOf(m.Payload)
+	if err != nil {
+		return fmt.Errorf("%w: chat: %w", notify.ErrUndeliverable, err)
+	}
+	var thread string
+	if m.Payload.Week != "" {
+		week, err := store.ParseLocalDate(m.Payload.Week)
+		if err != nil {
+			return fmt.Errorf("%w: chat: payload week: %w", notify.ErrUndeliverable, err)
+		}
+		thread = ThreadKey(week)
+	}
+	status, err := s.post(ctx, hook, msg, thread)
+	switch {
+	case err != nil:
+		return err
+	case status >= 200 && status < 300:
+		return nil
+	case status == http.StatusTooManyRequests || status >= 500:
+		return fmt.Errorf("chat: Google Chat answered status %d", status)
+	default:
+		return fmt.Errorf("%w: chat: Google Chat refused the message with status %d", notify.ErrUndeliverable, status)
+	}
+}
+
+// ThreadKey is the Chat thread of the week starting on week, such as
+// "mealquest-week-2026-W42": every message about a week goes in one thread.
+func ThreadKey(week store.LocalDate) string {
+	return "mealquest-week-" + household.PeriodKey(week)
+}
+
+// message is the body of a Google Chat webhook post.
+type message struct {
+	Text    string   `json:"text"`
+	CardsV2 []cardV2 `json:"cardsV2,omitempty"`
+}
+
+type cardV2 struct {
+	CardID string `json:"cardId"`
+	Card   card   `json:"card"`
+}
+
+type card struct {
+	Header   cardHeader    `json:"header"`
+	Sections []cardSection `json:"sections"`
+}
+
+type cardHeader struct {
+	Title    string `json:"title"`
+	Subtitle string `json:"subtitle,omitempty"`
+}
+
+type cardSection struct {
+	Widgets []cardWidget `json:"widgets"`
+}
+
+type cardWidget struct {
+	ButtonList buttonList `json:"buttonList"`
+}
+
+type buttonList struct {
+	Buttons []button `json:"buttons"`
+}
+
+type button struct {
+	Text    string  `json:"text"`
+	OnClick onClick `json:"onClick"`
+}
+
+type onClick struct {
+	OpenLink openLink `json:"openLink"`
+}
+
+type openLink struct {
+	URL string `json:"url"`
+}
+
+// messageOf is the Chat message of p: its Text and, for a plan or Supply
+// run, a card whose "Open" button links to p.URL under the public URL.
+func (s *Service) messageOf(p notify.Payload) (message, error) {
+	msg := message{Text: Text(p)}
+	if !carded[p.Event] {
+		return msg, nil
+	}
+	c, err := s.openCard(string(p.Event), p.Title, p.Body, p.URL)
+	if err != nil {
+		return message{}, err
+	}
+	msg.CardsV2 = []cardV2{c}
+	return msg, nil
+}
+
+// openCard is a card headed title and subtitle whose "Open" button links
+// to the app path under the public URL.
+func (s *Service) openCard(id, title, subtitle, path string) (cardV2, error) {
+	ref, err := url.Parse(path)
+	if err != nil || ref.Scheme != "" || ref.Host != "" || !strings.HasPrefix(path, "/") {
+		return cardV2{}, fmt.Errorf("payload url %q is not an app path", path)
+	}
+	link := s.publicURL.ResolveReference(ref)
+	return cardV2{
+		CardID: id,
+		Card: card{
+			Header: cardHeader{Title: title, Subtitle: subtitle},
+			Sections: []cardSection{{Widgets: []cardWidget{{ButtonList: buttonList{Buttons: []button{{
+				Text:    "Open",
+				OnClick: onClick{OpenLink: openLink{URL: link.String()}},
+			}}}}}}},
+		},
+	}, nil
+}
+
+// PostSupplyRun posts the Supply run of the week starting on week, named
+// name, with groups, to the stored webhook in the week's thread: its
+// SupplyRunText and a card whose "Open" button links to that week's Supply
+// run. No webhook stored is ErrNotConfigured; a post Google Chat does not
+// answer wraps ErrUnreachable, and one it answers with a status other than
+// 2xx is a *RefusedError.
+func (s *Service) PostSupplyRun(ctx context.Context, week store.LocalDate, name string, groups []SupplyRunGroup) error {
+	row, err := db.New(s.st.Reader).GetChatSettings(ctx)
+	if errors.Is(err, sql.ErrNoRows) {
+		return ErrNotConfigured
+	}
+	if err != nil {
+		return fmt.Errorf("chat: read chat settings: %w", err)
+	}
+	hook, err := s.open(row)
+	if err != nil {
+		return err
+	}
+	path := "/plan/shopping?" + url.Values{"week": {week.String()}}.Encode()
+	c, err := s.openCard("supply_run", "Supply run · "+name, "", path)
+	if err != nil {
+		return err
+	}
+	status, err := s.post(ctx, hook, message{Text: SupplyRunText(name, groups), CardsV2: []cardV2{c}}, ThreadKey(week))
+	if err != nil {
+		return err
+	}
+	if status < 200 || status >= 300 {
+		return &RefusedError{Status: status}
+	}
+	return nil
+}
+
+// post sends msg to hook, in thread when it is not empty, and returns the
+// status Google Chat answered. Its error never quotes the webhook URL.
+func (s *Service) post(ctx context.Context, hook Webhook, msg message, thread string) (int, error) {
+	body, err := json.Marshal(msg)
+	if err != nil {
+		return 0, fmt.Errorf("chat: encode message: %w", err)
+	}
+	target, err := url.Parse(hook.String())
+	if err != nil {
+		return 0, errors.New("chat: stored webhook URL does not parse")
+	}
+	if thread != "" {
+		q := target.Query()
+		q.Set("threadKey", thread)
+		q.Set("messageReplyOption", replyOption)
+		target.RawQuery = q.Encode()
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, target.String(), bytes.NewReader(body))
+	if err != nil {
+		return 0, errors.New("chat: build request to the webhook")
+	}
+	req.Header.Set("Content-Type", "application/json; charset=UTF-8")
+	resp, err := s.client.Do(req)
+	if err != nil {
+		// A *url.Error quotes the request URL, the webhook; keep only its
+		// cause.
+		var ue *url.Error
+		if errors.As(err, &ue) {
+			return 0, fmt.Errorf("%w: %w", ErrUnreachable, ue.Err)
+		}
+		return 0, ErrUnreachable
+	}
+	defer resp.Body.Close()
+	// The status is the outcome; the body is read only so the connection
+	// can be reused.
+	io.CopyN(io.Discard, resp.Body, maxDrainBytes)
+	return resp.StatusCode, nil
+}
+
+// open decrypts and validates the stored webhook. Its error never quotes
+// the URL.
+func (s *Service) open(row db.ChatSetting) (Webhook, error) {
+	raw, err := s.box.Decrypt(row.WebhookUrlCt)
+	if err != nil {
+		return Webhook{}, fmt.Errorf("chat: open stored webhook: %w", err)
+	}
+	hook, err := ParseWebhook(string(raw))
+	if err != nil {
+		return Webhook{}, fmt.Errorf("chat: stored webhook URL is invalid: %w", err)
+	}
+	return hook, nil
+}
+
+func (s *Service) timestamp() string {
+	return store.Timestamp{Time: s.now().UTC().Truncate(time.Millisecond)}.String()
+}
+
+func settingsFrom(row db.ChatSetting, hook Webhook) Settings {
+	masked := hook.Masked()
+	return Settings{
+		SpaceLabel:     nullString(row.SpaceLabel),
+		URLMasked:      &masked,
+		LastTestAt:     nullString(row.LastTestAt),
+		LastTestStatus: nullString(row.LastTestStatus),
+	}
+}
+
+func nullString(s sql.NullString) *string {
+	if !s.Valid {
+		return nil
+	}
+	return &s.String
+}

internal/chat/chat_test.go

@@ -0,0 +1,588 @@
+package chat
+
+import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"database/sql"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/db"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/household"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/notify"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/secretbox"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/store"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/migrations"
+)
+
+// posted is one request the fake Chat endpoint received.
+type posted struct {
+	Method, Host, Path string
+	Query              url.Values
+	ContentType        string
+	Body               map[string]any
+}
+
+// fakeChat is an httptest Google Chat endpoint answering status.
+type fakeChat struct {
+	srv *httptest.Server
+	mu  sync.Mutex
+	// status is what it answers.
+	status int
+	got    []posted
+}
+
+func newFakeChat(t *testing.T) *fakeChat {
+	t.Helper()
+	f := &fakeChat{status: http.StatusOK}
+	f.srv = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		data, _ := io.ReadAll(r.Body)
+		var body map[string]any
+		if err := json.Unmarshal(data, &body); err != nil {
+			t.Errorf("Chat endpoint body %q: %v", data, err)
+		}
+		f.mu.Lock()
+		f.got = append(f.got, posted{r.Method, r.Host, r.URL.Path, r.URL.Query(), r.Header.Get("Content-Type"), body})
+		status := f.status
+		f.mu.Unlock()
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(status)
+		w.Write([]byte(`{}`))
+	}))
+	t.Cleanup(f.srv.Close)
+	return f
+}
+
+func (f *fakeChat) setStatus(status int) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.status = status
+}
+
+func (f *fakeChat) requests() []posted {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return append([]posted(nil), f.got...)
+}
+
+// redirectTo sends every request to the server at target, keeping its path
+// and query, as if it were chat.googleapis.com.
+type redirectTo struct {
+	target *url.URL
+}
+
+func (r redirectTo) RoundTrip(req *http.Request) (*http.Response, error) {
+	out := req.Clone(req.Context())
+	out.URL.Scheme, out.URL.Host = r.target.Scheme, r.target.Host
+	out.Host = req.URL.Host
+	return http.DefaultTransport.RoundTrip(out)
+}
+
+func newTestStore(t *testing.T) *store.Store {
+	t.Helper()
+	ctx := context.Background()
+	st, err := store.Open(ctx, t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		if err := st.Close(); err != nil {
+			t.Error(err)
+		}
+	})
+	if err := store.Migrate(ctx, st.Writer, migrations.FS); err != nil {
+		t.Fatal(err)
+	}
+	return st
+}
+
+func newTestBox(t *testing.T) *secretbox.Box {
+	t.Helper()
+	key := make([]byte, secretbox.KeySize)
+	rand.Read(key)
+	box, err := secretbox.New(base64.StdEncoding.EncodeToString(key))
+	if err != nil {
+		t.Fatal(err)
+	}
+	return box
+}
+
+// newTestService returns a service over a migrated temp database whose
+// requests go to f, with cards linking under https://mealquest.example.
+func newTestService(t *testing.T, f *fakeChat) (*Service, *store.Store) {
+	t.Helper()
+	st := newTestStore(t)
+	target, err := url.Parse(f.srv.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	pub, err := url.Parse("https://mealquest.example")
+	if err != nil {
+		t.Fatal(err)
+	}
+	svc, err := NewService(st, newTestBox(t), pub, redirectTo{target})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return svc, st
+}
+
+// assertNoSecret fails when s holds the webhook URL, its key or its token.
+func assertNoSecret(t *testing.T, what, s string) {
+	t.Helper()
+	tokenDecoded, _ := url.QueryUnescape(testToken)
+	for _, secret := range []string{testHook, testKey, testToken, tokenDecoded, testKey[:12], testToken[:12]} {
+		if strings.Contains(s, secret) {
+			t.Errorf("%s holds the webhook URL or a credential: %s", what, s)
+			return
+		}
+	}
+}
+
+func TestNewServiceRequiresDependencies(t *testing.T) {
+	t.Parallel()
+	st, box := newTestStore(t), newTestBox(t)
+	pub, _ := url.Parse("https://mealquest.example")
+	for name, build := range map[string]func() (*Service, error){
+		"store":      func() (*Service, error) { return NewService(nil, box, pub, http.DefaultTransport) },
+		"box":        func() (*Service, error) { return NewService(st, nil, pub, http.DefaultTransport) },
+		"public URL": func() (*Service, error) { return NewService(st, box, nil, http.DefaultTransport) },
+		"transport":  func() (*Service, error) { return NewService(st, box, pub, nil) },
+	} {
+		if _, err := build(); err == nil {
+			t.Errorf("NewService without %s succeeded", name)
+		}
+	}
+}
+
+func TestPutGetStoresSealedWebhook(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+	svc, st := newTestService(t, newFakeChat(t))
+
+	got, err := svc.Get(ctx)
+	if err != nil || got.SpaceLabel != nil || got.URLMasked != nil || got.LastTestAt != nil {
+		t.Fatalf("Get unconfigured = %+v, %v", got, err)
+	}
+
+	put, err := svc.Put(ctx, testHook, "  Family dinner  ")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if *put.SpaceLabel != "Family dinner" || *put.URLMasked != "https://chat.googleapis.com/v1/spaces/"+testSpace+"/messages?key=…&token=…ZxQ=" || put.LastTestAt != nil || put.LastTestStatus != nil {
+		t.Errorf("Put = %+v", put)
+	}
+	got, err = svc.Get(ctx)
+	if err != nil || *got.URLMasked != *put.URLMasked || *got.SpaceLabel != "Family dinner" {
+		t.Errorf("Get = %+v, %v", got, err)
+	}
+
+	row, err := db.New(st.Reader).GetChatSettings(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if bytes.Contains(row.WebhookUrlCt, []byte(testKey)) || bytes.Contains(row.WebhookUrlCt, []byte("chat.googleapis.com")) {
+		t.Errorf("webhook_url_ct holds the URL in plain text")
+	}
+	plain, err := svc.box.Decrypt(row.WebhookUrlCt)
+	if err != nil || string(plain) != testHook {
+		t.Errorf("webhook_url_ct decrypts to %q, %v", plain, err)
+	}
+	encoded, _ := json.Marshal(got)
+	assertNoSecret(t, "GET settings", string(encoded))
+}
+
+func TestPutRefusesInvalid(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+	svc, st := newTestService(t, newFakeChat(t))
+	for _, tc := range []struct {
+		url, label string
+		fields     []string
+	}{
+		{"https://chat.googleapis.com.evil.example/v1/spaces/X/messages?key=" + testKey + "&token=" + testToken, "Family", []string{"url"}},
+		{testHook, "   ", []string{"space_label"}},
+		{testHook, strings.Repeat("x", MaxSpaceLabelChars+1), []string{"space_label"}},
+		{testHook, "bad\nlabel", []string{"space_label"}},
+		{"http://chat.googleapis.com/v1/spaces/X/messages?key=" + testKey + "&token=" + testToken, "", []string{"url", "space_label"}},
+	} {
+		_, err := svc.Put(ctx, tc.url, tc.label)
+		var invalid *ValidationError
+		if !errors.As(err, &invalid) || len(invalid.Problems) != len(tc.fields) {
+			t.Errorf("Put(%q, %q) = %v, want problems with %v", tc.url, tc.label, err, tc.fields)
+			continue
+		}
+		for i, p := range invalid.Problems {
+			if p.Field != tc.fields[i] {
+				t.Errorf("Put(%q, %q) problem %d = %s, want %s", tc.url, tc.label, i, p.Field, tc.fields[i])
+			}
+		}
+		assertNoSecret(t, "validation error", err.Error())
+	}
+	if _, err := db.New(st.Reader).GetChatSettings(ctx); !errors.Is(err, sql.ErrNoRows) {
+		t.Errorf("a refused Put stored a row: %v", err)
+	}
+}
+
+func TestTestRecordsOutcome(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+	f := newFakeChat(t)
+	svc, _ := newTestService(t, f)
+	svc.now = func() time.Time { return time.Date(2026, 10, 9, 15, 0, 0, 0, time.UTC) }
+
+	if _, err := svc.Test(ctx); !errors.Is(err, ErrNotConfigured) {
+		t.Fatalf("Test unconfigured = %v, want ErrNotConfigured", err)
+	}
+	if _, err := svc.Put(ctx, testHook, "Family"); err != nil {
+		t.Fatal(err)
+	}
+
+	res, err := svc.Test(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if res.HTTPStatus != 200 || *res.LastTestStatus != TestOK || *res.LastTestAt != "2026-10-09T15:00:00.000Z" {
+		t.Errorf("Test = %+v, want 200 ok", res)
+	}
+	reqs := f.requests()
+	if len(reqs) != 1 {
+		t.Fatalf("Chat got %d requests, want 1", len(reqs))
+	}
+	r := reqs[0]
+	if r.Method != http.MethodPost || r.Host != "chat.googleapis.com" || r.Path != "/v1/spaces/"+testSpace+"/messages" ||
+		r.Query.Get("key") != testKey || r.Query.Get("threadKey") != "" || r.Body["text"] != TestText || r.Body["cardsV2"] != nil {
+		t.Errorf("test request = %+v", r)
+	}
+
+	f.setStatus(http.StatusNotFound)
+	res, err = svc.Test(ctx)
+	if err != nil || res.HTTPStatus != 404 || *res.LastTestStatus != TestFailed {
+		t.Errorf("Test answered 404 = %+v, %v; want 404 failed", res, err)
+	}
+	got, _ := svc.Get(ctx)
+	if *got.LastTestStatus != TestFailed || *got.LastTestAt != "2026-10-09T15:00:00.000Z" {
+		t.Errorf("Get after a failed test = %+v", got)
+	}
+
+	// A new webhook has no test outcome.
+	got, err = svc.Put(ctx, testHook, "Family")
+	if err != nil || got.LastTestAt != nil || got.LastTestStatus != nil {
+		t.Errorf("Put after a test = %+v, %v; want the outcome cleared", got, err)
+	}
+
+	f.srv.Close()
+	_, err = svc.Test(ctx)
+	if !errors.Is(err, ErrUnreachable) {
+		t.Errorf("Test against a stopped endpoint = %v, want ErrUnreachable", err)
+	} else {
+		assertNoSecret(t, "unreachable error", err.Error())
+	}
+	if got, _ := svc.Get(ctx); got.LastTestStatus == nil || *got.LastTestStatus != TestFailed {
+		t.Errorf("Get after an unanswered test = %+v, want failed", got)
+	}
+}
+
+func TestSendThreadsByWeek(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+	f := newFakeChat(t)
+	svc, _ := newTestService(t, f)
+	if _, err := svc.Put(ctx, testHook, "Family"); err != nil {
+		t.Fatal(err)
+	}
+	week := mustDate(t, "2026-10-12")
+	events := []notify.Event{
+		PlanReady(week, week, []string{"Tacos", "Bolognese", "Tikka masala", "A", "B", "C", "D"}),
+		ListReady(week, 19, 7),
+		DayOfReminder(mustDate(t, "2026-10-18"), "01J9DINNER", "Tacos"),
+		NewSuggestions("01J9BATCH", week, []string{"Pho"}),
+		RotationReview("01J9DINNER", "Pho", week),
+	}
+	for _, ev := range events {
+		if err := svc.Send(ctx, notify.Message{ID: "n1", EventKey: ev.Key, Channel: notify.ChannelChat, Payload: payloadOf(ev), Attempt: 1}); err != nil {
+			t.Fatalf("Send %s: %v", ev.Type, err)
+		}
+	}
+	reqs := f.requests()
+	if len(reqs) != len(events) {
+		t.Fatalf("Chat got %d requests, want %d", len(reqs), len(events))
+	}
+	for i, r := range reqs {
+		ev := events[i]
+		if r.Method != http.MethodPost || r.Path != "/v1/spaces/"+testSpace+"/messages" || !strings.HasPrefix(r.ContentType, "application/json") {
+			t.Errorf("%s: request = %+v", ev.Type, r)
+		}
+		if r.Query.Get("key") != testKey || r.Query.Get("token") != strings.ReplaceAll(testToken, "%3D", "=") {
+			t.Errorf("%s: key and token not kept: %v", ev.Type, r.Query)
+		}
+		if r.Query.Get("threadKey") != "mealquest-week-2026-W42" || r.Query.Get("messageReplyOption") != "REPLY_MESSAGE_FALLBACK_TO_NEW_THREAD" {
+			t.Errorf("%s: threading = %v", ev.Type, r.Query)
+		}
+		if want := Text(payloadOf(ev)); r.Body["text"] != want {
+			t.Errorf("%s: text = %q, want %q", ev.Type, r.Body["text"], want)
+		}
+		_, hasCards := r.Body["cardsV2"]
+		if hasCards != (ev.Type == notify.PlanReady || ev.Type == notify.ListReady) {
+			t.Errorf("%s: cardsV2 present = %v", ev.Type, hasCards)
+		}
+	}
+	if reqs[0].Body["text"] != "This week's plan is ready: Tacos, Bolognese, Tikka masala + 4 more. Open the plan →" {
+		t.Errorf("plan text = %q", reqs[0].Body["text"])
+	}
+
+	// The cards' "Open" buttons link under the public URL.
+	for i, wantLink := range map[int]string{0: "https://mealquest.example/plan", 1: "https://mealquest.example/plan/shopping"} {
+		data, _ := json.Marshal(reqs[i].Body["cardsV2"])
+		var cards []cardV2
+		if err := json.Unmarshal(data, &cards); err != nil || len(cards) != 1 {
+			t.Fatalf("cardsV2 = %s, %v", data, err)
+		}
+		c := cards[0]
+		buttons := c.Card.Sections[0].Widgets[0].ButtonList.Buttons
+		if c.CardID != string(events[i].Type) || c.Card.Header.Title != events[i].Title || c.Card.Header.Subtitle != events[i].Body ||
+			len(buttons) != 1 || buttons[0].Text != "Open" || buttons[0].OnClick.OpenLink.URL != wantLink {
+			t.Errorf("%s card = %s, want an Open button to %s", events[i].Type, data, wantLink)
+		}
+	}
+}
+
+func TestSendWithoutWeekIsUnthreaded(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+	f := newFakeChat(t)
+	svc, _ := newTestService(t, f)
+	if _, err := svc.Put(ctx, testHook, "Family"); err != nil {
+		t.Fatal(err)
+	}
+	p := notify.Payload{Event: notify.RotationReview, Title: "Keep it in rotation?", URL: "/", Tag: "rotation_review:x"}
+	if err := svc.Send(ctx, notify.Message{Payload: p}); err != nil {
+		t.Fatal(err)
+	}
+	if q := f.requests()[0].Query; q.Has("threadKey") || q.Has("messageReplyOption") {
+		t.Errorf("query = %v, want no threading", q)
+	}
+}
+
+func TestSendClassifiesStatus(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+	f := newFakeChat(t)
+	svc, _ := newTestService(t, f)
+	if _, err := svc.Put(ctx, testHook, "Family"); err != nil {
+		t.Fatal(err)
+	}
+	m := notify.Message{Payload: payloadOf(PlanReady(mustDate(t, "2026-10-12"), mustDate(t, "2026-10-12"), []string{"Tacos"}))}
+	for _, tc := range []struct {
+		status        int
+		ok, permanent bool
+	}{
+		{200, true, false},
+		{204, true, false},
+		{301, false, true},
+		{400, false, true},
+		{401, false, true},
+		{403, false, true},
+		{404, false, true},
+		{413, false, true},
+		{429, false, false},
+		{500, false, false},
+		{502, false, false},
+		{503, false, false},
+	} {
+		f.setStatus(tc.status)
+		err := svc.Send(ctx, m)
+		if (err == nil) != tc.ok || errors.Is(err, notify.ErrUndeliverable) != tc.permanent {
+			t.Errorf("status %d: Send = %v, want ok %v, undeliverable %v", tc.status, err, tc.ok, tc.permanent)
+		}
+		if err != nil {
+			assertNoSecret(t, "Send error", err.Error())
+		}
+	}
+
+	f.srv.Close()
+	err := svc.Send(ctx, m)
+	if err == nil || errors.Is(err, notify.ErrUndeliverable) {
+		t.Errorf("Send to a stopped endpoint = %v, want a retryable error", err)
+	} else {
+		assertNoSecret(t, "Send error", err.Error())
+	}
+}
+
+func TestSendWithoutWebhookIsUndeliverable(t *testing.T) {
+	t.Parallel()
+	svc, _ := newTestService(t, newFakeChat(t))
+	err := svc.Send(context.Background(), notify.Message{Payload: payloadOf(ListReady(mustDate(t, "2026-10-12"), 3, 2))})
+	if !errors.Is(err, notify.ErrUndeliverable) || !errors.Is(err, ErrNotConfigured) {
+		t.Errorf("Send = %v, want undeliverable, not configured", err)
+	}
+}
+
+// TestOutboxRowsFollowClassification delivers through the notify worker: a
+// 400 fails the row at once, a 503 leaves it pending for a retry. Neither
+// the stored error nor the log holds the webhook URL.
+func TestOutboxRowsFollowClassification(t *testing.T) {
+	t.Parallel()
+	ctx, cancel := context.WithCancel(context.Background())
+	f := newFakeChat(t)
+	svc, st := newTestService(t, f)
+	if _, err := svc.Put(ctx, testHook, "Family"); err != nil {
+		t.Fatal(err)
+	}
+	if err := household.SeedNotificationPrefs(ctx, st); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := st.Writer.Exec(`UPDATE notification_prefs SET push = 0, chat = 1`); err != nil {
+		t.Fatal(err)
+	}
+	var logs syncBuffer
+	notifier, err := notify.NewService(st, slog.New(slog.NewTextHandler(&logs, nil)))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := notifier.Register(notify.ChannelChat, svc); err != nil {
+		t.Fatal(err)
+	}
+	if err := notifier.Start(ctx); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		cancel()
+		notifier.Wait()
+	})
+
+	week := mustDate(t, "2026-10-12")
+	f.setStatus(http.StatusBadRequest)
+	planned := PlanReady(week, week, []string{"Tacos"})
+	if err := notifier.Emit(ctx, planned); err != nil {
+		t.Fatal(err)
+	}
+	status, lastErr := waitForAttempt(t, st, planned.Key)
+	if status != "failed" || !strings.Contains(lastErr, "status 400") {
+		t.Errorf("row after a 400 = %s %q, want failed", status, lastErr)
+	}
+
+	f.setStatus(http.StatusServiceUnavailable)
+	listed := ListReady(week, 3, 1)
+	if err := notifier.Emit(ctx, listed); err != nil {
+		t.Fatal(err)
+	}
+	status, lastErr = waitForAttempt(t, st, listed.Key)
+	if status != "pending" || !strings.Contains(lastErr, "status 503") {
+		t.Errorf("row after a 503 = %s %q, want pending for a retry", status, lastErr)
+	}
+	cancel()
+	notifier.Wait()
+	assertNoSecret(t, "log", logs.String())
+	assertNoSecret(t, "last_error", lastErr)
+}
+
+// waitForAttempt waits for the chat row of key to have been attempted and
+// returns its status and last error.
+func waitForAttempt(t *testing.T, st *store.Store, key string) (string, string) {
+	t.Helper()
+	deadline := time.Now().Add(5 * time.Second)
+	for time.Now().Before(deadline) {
+		var status string
+		var attempts int
+		var lastErr sql.NullString
+		err := st.Reader.QueryRow(`SELECT status, attempts, last_error FROM notification_outbox WHERE event_key = ? AND channel = 'chat'`, key).
+			Scan(&status, &attempts, &lastErr)
+		if err != nil && !errors.Is(err, sql.ErrNoRows) {
+			t.Fatal(err)
+		}
+		if attempts > 0 {
+			return status, lastErr.String
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+	t.Fatalf("chat row of %s was never attempted", key)
+	return "", ""
+}
+
+// syncBuffer is a bytes.Buffer safe for the worker's logger.
+type syncBuffer struct {
+	mu  sync.Mutex
+	buf bytes.Buffer
+}
+
+func (b *syncBuffer) Write(p []byte) (int, error) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	return b.buf.Write(p)
+}
+
+func (b *syncBuffer) String() string {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	return b.buf.String()
+}
+
+func TestPostSupplyRun(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+	f := newFakeChat(t)
+	svc, _ := newTestService(t, f)
+	week := mustDate(t, "2026-10-12")
+	groups := []SupplyRunGroup{{Dinner: "Tacos", Items: []SupplyRunItem{{Name: "tortillas"}}}}
+
+	if err := svc.PostSupplyRun(ctx, week, "Week 42 · Oct 12 – 18", groups); !errors.Is(err, ErrNotConfigured) {
+		t.Fatalf("PostSupplyRun without a webhook = %v, want ErrNotConfigured", err)
+	}
+	if _, err := svc.Put(ctx, testHook, "Family"); err != nil {
+		t.Fatal(err)
+	}
+	if err := svc.PostSupplyRun(ctx, week, "Week 42 · Oct 12 – 18", groups); err != nil {
+		t.Fatal(err)
+	}
+	reqs := f.requests()
+	if len(reqs) != 1 {
+		t.Fatalf("Chat got %d requests, want 1", len(reqs))
+	}
+	r := reqs[0]
+	if r.Query.Get("threadKey") != "mealquest-week-2026-W42" || r.Query.Get("messageReplyOption") != replyOption {
+		t.Errorf("threading = %v", r.Query)
+	}
+	if want := SupplyRunText("Week 42 · Oct 12 – 18", groups); r.Body["text"] != want {
+		t.Errorf("text = %q, want %q", r.Body["text"], want)
+	}
+	data, _ := json.Marshal(r.Body["cardsV2"])
+	var cards []cardV2
+	if err := json.Unmarshal(data, &cards); err != nil || len(cards) != 1 {
+		t.Fatalf("cardsV2 = %s, %v", data, err)
+	}
+	buttons := cards[0].Card.Sections[0].Widgets[0].ButtonList.Buttons
+	if cards[0].Card.Header.Title != "Supply run · Week 42 · Oct 12 – 18" || len(buttons) != 1 ||
+		buttons[0].OnClick.OpenLink.URL != "https://mealquest.example/plan/shopping?week=2026-10-12" {
+		t.Errorf("card = %s, want an Open button to the week's Supply run", data)
+	}
+
+	f.setStatus(http.StatusForbidden)
+	err := svc.PostSupplyRun(ctx, week, "Week 42 · Oct 12 – 18", groups)
+	if !errors.Is(err, ErrRefused) || !strings.Contains(err.Error(), "403") {
+		t.Errorf("PostSupplyRun answered 403 = %v, want ErrRefused with the status", err)
+	}
+	if err != nil {
+		assertNoSecret(t, "refused error", err.Error())
+	}
+
+	f.srv.Close()
+	err = svc.PostSupplyRun(ctx, week, "Week 42 · Oct 12 – 18", groups)
+	if !errors.Is(err, ErrUnreachable) {
+		t.Errorf("PostSupplyRun unanswered = %v, want ErrUnreachable", err)
+	}
+	if err != nil {
+		assertNoSecret(t, "unreachable error", err.Error())
+	}
+}

internal/chat/chattest/chattest.go

@@ -0,0 +1,97 @@
+// Package chattest provides a fake Google Chat incoming webhook for tests
+// of the features that post to Google Chat: an httptest server that
+// records each post and answers a status the test sets, reached through a
+// transport that sends chat.googleapis.com requests to it.
+package chattest
+
+import (
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"sync"
+	"testing"
+)
+
+// Webhook is a valid Google Chat incoming webhook URL to store.
+const Webhook = "https://chat.googleapis.com/v1/spaces/AAQA1b2C3d4/messages?key=AIzaSyDdI0hCZtE6vySjMm-WEfRq3CPzqKqqsHI&token=q0Lz3kV9Yw8pXcRtN2bHsJdFgA7uEmKiOlP1nZxQ%3D"
+
+// Post is one message the fake received.
+type Post struct {
+	// Query is the request's query: key, token and any threading.
+	Query url.Values
+	// Body is the decoded JSON message.
+	Body map[string]any
+}
+
+// Text is the post's text.
+func (p Post) Text() string {
+	s, _ := p.Body["text"].(string)
+	return s
+}
+
+// Chat is a fake Google Chat endpoint. It answers 200 until SetStatus.
+type Chat struct {
+	srv    *httptest.Server
+	mu     sync.Mutex
+	status int
+	posts  []Post
+}
+
+// New starts a fake Google Chat endpoint, closed when the test ends.
+func New(t *testing.T) *Chat {
+	t.Helper()
+	c := &Chat{status: http.StatusOK}
+	c.srv = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		data, _ := io.ReadAll(r.Body)
+		var body map[string]any
+		if err := json.Unmarshal(data, &body); err != nil {
+			t.Errorf("Google Chat post body %q: %v", data, err)
+		}
+		c.mu.Lock()
+		c.posts = append(c.posts, Post{Query: r.URL.Query(), Body: body})
+		status := c.status
+		c.mu.Unlock()
+		w.WriteHeader(status)
+	}))
+	t.Cleanup(c.srv.Close)
+	return c
+}
+
+// Transport sends every request to the fake, as if it were
+// chat.googleapis.com.
+func (c *Chat) Transport() http.RoundTripper {
+	return transport{c}
+}
+
+type transport struct{ c *Chat }
+
+func (tr transport) RoundTrip(req *http.Request) (*http.Response, error) {
+	target, err := url.Parse(tr.c.srv.URL)
+	if err != nil {
+		return nil, err
+	}
+	out := req.Clone(req.Context())
+	out.URL.Scheme, out.URL.Host = target.Scheme, target.Host
+	return http.DefaultTransport.RoundTrip(out)
+}
+
+// SetStatus makes the fake answer status from now on.
+func (c *Chat) SetStatus(status int) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.status = status
+}
+
+// Close stops the fake, so posts get no answer.
+func (c *Chat) Close() {
+	c.srv.Close()
+}
+
+// Posts returns the messages received so far, in order.
+func (c *Chat) Posts() []Post {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return append([]Post(nil), c.posts...)
+}

internal/chat/messages.go

@@ -0,0 +1,214 @@
+package chat
+
+import (
+	"fmt"
+	"strings"
+	"time"
+
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/household"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/notify"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/store"
+)
+
+// This file is the one place the notification texts are written. The
+// builders make the notify.Event of each event type, whose title and body
+// the push channel shows as they are; Text turns its payload into the Google
+// Chat message, such as "This week's plan is ready: Tacos, Bolognese,
+// Tikka masala + 4 more. Open the plan →".
+
+// TestText is the message POST /settings/chat-webhook/test sends.
+const TestText = "MealQuest · test message"
+
+// listedNames is how many names a message lists before "+ N more".
+const listedNames = 3
+
+// actions is the closing call to action of each event's Chat message.
+var actions = map[notify.EventType]string{
+	notify.PlanReady:      "Open the plan",
+	notify.ListReady:      "Open the Supply run",
+	notify.DayOfReminder:  "Open the recipe",
+	notify.NewSuggestions: "Open Discover",
+	notify.RotationReview: "Open MealQuest",
+}
+
+// carded are the events whose Chat message also has a card with an "Open"
+// button.
+var carded = map[notify.EventType]bool{notify.PlanReady: true, notify.ListReady: true}
+
+// PlanReady is the plan_ready event of the week starting on week, drafted
+// in the week starting on thisWeek, naming its dinners in plan order. Its
+// title names the week as seen from thisWeek: "Next week's plan is ready",
+// "This week's plan is ready", or "The plan for the week of Oct 26 is
+// ready" for any other week.
+func PlanReady(week, thisWeek store.LocalDate, dinners []string) notify.Event {
+	return notify.Event{
+		Type:  notify.PlanReady,
+		Key:   string(notify.PlanReady) + ":" + week.String(),
+		Title: planTitle(week, thisWeek),
+		Body:  nameList(dinners),
+		URL:   "/plan",
+		Week:  week,
+	}
+}
+
+// ListReady is the list_ready event of the Supply run of the week starting
+// on week: needed items to buy for its dinners.
+func ListReady(week store.LocalDate, needed, dinners int) notify.Event {
+	return notify.Event{
+		Type:  notify.ListReady,
+		Key:   string(notify.ListReady) + ":" + week.String(),
+		Title: "This week's Supply run is ready",
+		Body:  fmt.Sprintf("%s to buy for %s", count(needed, "item", "items"), count(dinners, "dinner", "dinners")),
+		URL:   "/plan/shopping",
+		Week:  week,
+	}
+}
+
+// DayOfReminder is the day_of_reminder event of the dinner dinnerID, named
+// name, planned on date.
+func DayOfReminder(date store.LocalDate, dinnerID, name string) notify.Event {
+	return notify.Event{
+		Type:  notify.DayOfReminder,
+		Key:   string(notify.DayOfReminder) + ":" + date.String(),
+		Title: "Tonight's dinner",
+		Body:  name,
+		URL:   "/dinner/" + dinnerID,
+		Week:  household.WeekStart(date),
+	}
+}
+
+// NewSuggestions is the new_suggestions event of suggestion batch batchID,
+// made in the week starting on week, naming its Side quests.
+func NewSuggestions(batchID string, week store.LocalDate, names []string) notify.Event {
+	return notify.Event{
+		Type:  notify.NewSuggestions,
+		Key:   string(notify.NewSuggestions) + ":" + batchID,
+		Title: "New Side quests are in",
+		Body:  nameList(names),
+		URL:   "/discover",
+		Week:  week,
+	}
+}
+
+// RotationReview is the rotation_review event asking whether the dinner
+// dinnerID, named name and tried in the week starting on week, becomes a
+// Regular.
+func RotationReview(dinnerID, name string, week store.LocalDate) notify.Event {
+	return notify.Event{
+		Type:  notify.RotationReview,
+		Key:   string(notify.RotationReview) + ":" + dinnerID,
+		Title: "Keep it in rotation?",
+		Body:  "You tried " + name + ". Make it a Regular?",
+		URL:   "/",
+		Week:  week,
+	}
+}
+
+// SupplyRunItem is a Supply run item still needed, as sent to Google Chat;
+// Qty is empty when the recipe gives none.
+type SupplyRunItem struct {
+	Name string
+	Qty  string
+}
+
+// SupplyRunGroup is one dinner of a Supply run sent to Google Chat, with
+// its items still needed.
+type SupplyRunGroup struct {
+	Dinner string
+	Items  []SupplyRunItem
+}
+
+// SupplyRunText is the Google Chat message of the Supply run named name
+// (its title, or its week label until it has one): each dinner with items
+// still needed in bold, its items one per line, and the call to action.
+//
+//	Supply run · Week 42 · Oct 12 – 18
+//
+//	*Tacos*
+//	• ground beef — 1 lb
+//	• tortillas
+//
+//	Open the Supply run →
+//
+// A Supply run with nothing still needed says so.
+func SupplyRunText(name string, groups []SupplyRunGroup) string {
+	var b strings.Builder
+	b.WriteString("Supply run · " + name)
+	listed := false
+	for _, g := range groups {
+		if len(g.Items) == 0 {
+			continue
+		}
+		listed = true
+		b.WriteString("\n\n*" + g.Dinner + "*")
+		for _, it := range g.Items {
+			b.WriteString("\n• " + it.Name)
+			if it.Qty != "" {
+				b.WriteString(" — " + it.Qty)
+			}
+		}
+	}
+	if !listed {
+		b.WriteString("\n\nNothing left to buy.")
+	}
+	b.WriteString("\n\n" + actions[notify.ListReady] + " →")
+	return b.String()
+}
+
+// planTitle is the plan_ready title of the week starting on week, seen
+// from the week starting on thisWeek.
+func planTitle(week, thisWeek store.LocalDate) string {
+	y, m, d := thisWeek.Date()
+	next := store.LocalDateOf(time.Date(y, m, d+7, 0, 0, 0, 0, time.UTC))
+	switch week {
+	case thisWeek:
+		return "This week's plan is ready"
+	case next:
+		return "Next week's plan is ready"
+	}
+	_, m, d = week.Date()
+	return fmt.Sprintf("The plan for the week of %s %d is ready", m.String()[:3], d)
+}
+
+// Text is the Google Chat message of p: its title, its body after a colon
+// and the event's call to action with an arrow.
+func Text(p notify.Payload) string {
+	text := p.Title
+	if p.Body != "" {
+		if endsSentence(text) {
+			text += " "
+		} else {
+			text += ": "
+		}
+		text += p.Body
+	}
+	if !endsSentence(text) {
+		text += "."
+	}
+	if action, ok := actions[p.Event]; ok {
+		text += " " + action + " →"
+	}
+	return text
+}
+
+// endsSentence reports whether s ends with sentence punctuation.
+func endsSentence(s string) bool {
+	return strings.HasSuffix(s, ".") || strings.HasSuffix(s, "?") || strings.HasSuffix(s, "!")
+}
+
+// nameList lists the first listedNames of names, then how many more there
+// are: "Tacos, Bolognese, Tikka masala + 4 more".
+func nameList(names []string) string {
+	if len(names) <= listedNames {
+		return strings.Join(names, ", ")
+	}
+	return fmt.Sprintf("%s + %d more", strings.Join(names[:listedNames], ", "), len(names)-listedNames)
+}
+
+// count is n with the singular or plural noun.
+func count(n int, one, many string) string {
+	if n == 1 {
+		return "1 " + one
+	}
+	return fmt.Sprintf("%d %s", n, many)
+}

internal/chat/messages_test.go

@@ -0,0 +1,174 @@
+package chat
+
+import (
+	"testing"
+
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/notify"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/store"
+)
+
+func mustDate(t *testing.T, s string) store.LocalDate {
+	t.Helper()
+	d, err := store.ParseLocalDate(s)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return d
+}
+
+// payloadOf is the payload notify stores for ev.
+func payloadOf(ev notify.Event) notify.Payload {
+	p := notify.Payload{Event: ev.Type, Title: ev.Title, Body: ev.Body, URL: ev.URL, Tag: ev.Key}
+	if !ev.Week.IsZero() {
+		p.Week = ev.Week.String()
+	}
+	return p
+}
+
+func TestMessages(t *testing.T) {
+	t.Parallel()
+	week := mustDate(t, "2026-10-12")
+	for _, tc := range []struct {
+		name               string
+		ev                 notify.Event
+		key, url, week     string
+		title, body, chatT string
+	}{
+		{
+			name:  "plan ready",
+			ev:    PlanReady(week, week, []string{"Tacos", "Bolognese", "Tikka masala", "Lemon orzo", "Bibimbap", "Shakshuka", "Chili"}),
+			key:   "plan_ready:2026-10-12",
+			url:   "/plan",
+			week:  "2026-10-12",
+			title: "This week's plan is ready",
+			body:  "Tacos, Bolognese, Tikka masala + 4 more",
+			chatT: "This week's plan is ready: Tacos, Bolognese, Tikka masala + 4 more. Open the plan →",
+		},
+		{
+			name:  "plan ready with three dinners",
+			ev:    PlanReady(week, week, []string{"Tacos", "Bolognese", "Tikka masala"}),
+			key:   "plan_ready:2026-10-12",
+			url:   "/plan",
+			week:  "2026-10-12",
+			title: "This week's plan is ready",
+			body:  "Tacos, Bolognese, Tikka masala",
+			chatT: "This week's plan is ready: Tacos, Bolognese, Tikka masala. Open the plan →",
+		},
+		{
+			name:  "plan ready for next week",
+			ev:    PlanReady(week, mustDate(t, "2026-10-05"), []string{"Tacos", "Bolognese", "Tikka masala", "Lemon orzo"}),
+			key:   "plan_ready:2026-10-12",
+			url:   "/plan",
+			week:  "2026-10-12",
+			title: "Next week's plan is ready",
+			body:  "Tacos, Bolognese, Tikka masala + 1 more",
+			chatT: "Next week's plan is ready: Tacos, Bolognese, Tikka masala + 1 more. Open the plan →",
+		},
+		{
+			name:  "plan ready for a later week",
+			ev:    PlanReady(mustDate(t, "2026-10-26"), mustDate(t, "2026-10-05"), []string{"Tacos"}),
+			key:   "plan_ready:2026-10-26",
+			url:   "/plan",
+			week:  "2026-10-26",
+			title: "The plan for the week of Oct 26 is ready",
+			body:  "Tacos",
+			chatT: "The plan for the week of Oct 26 is ready: Tacos. Open the plan →",
+		},
+		{
+			name:  "list ready",
+			ev:    ListReady(week, 19, 7),
+			key:   "list_ready:2026-10-12",
+			url:   "/plan/shopping",
+			week:  "2026-10-12",
+			title: "This week's Supply run is ready",
+			body:  "19 items to buy for 7 dinners",
+			chatT: "This week's Supply run is ready: 19 items to buy for 7 dinners. Open the Supply run →",
+		},
+		{
+			name:  "list ready singular",
+			ev:    ListReady(week, 1, 1),
+			key:   "list_ready:2026-10-12",
+			url:   "/plan/shopping",
+			week:  "2026-10-12",
+			title: "This week's Supply run is ready",
+			body:  "1 item to buy for 1 dinner",
+			chatT: "This week's Supply run is ready: 1 item to buy for 1 dinner. Open the Supply run →",
+		},
+		{
+			name:  "day-of reminder",
+			ev:    DayOfReminder(mustDate(t, "2026-10-15"), "01J9Z8Y7X6W5V4T3S2R1Q0P9N8", "Tacos"),
+			key:   "day_of_reminder:2026-10-15",
+			url:   "/dinner/01J9Z8Y7X6W5V4T3S2R1Q0P9N8",
+			week:  "2026-10-12",
+			title: "Tonight's dinner",
+			body:  "Tacos",
+			chatT: "Tonight's dinner: Tacos. Open the recipe →",
+		},
+		{
+			name:  "new suggestions",
+			ev:    NewSuggestions("01J9BATCH", week, []string{"Lemon orzo", "Bibimbap", "Shakshuka", "Pho", "Paella"}),
+			key:   "new_suggestions:01J9BATCH",
+			url:   "/discover",
+			week:  "2026-10-12",
+			title: "New Side quests are in",
+			body:  "Lemon orzo, Bibimbap, Shakshuka + 2 more",
+			chatT: "New Side quests are in: Lemon orzo, Bibimbap, Shakshuka + 2 more. Open Discover →",
+		},
+		{
+			name:  "rotation review",
+			ev:    RotationReview("01J9DINNER", "Lemon orzo", week),
+			key:   "rotation_review:01J9DINNER",
+			url:   "/",
+			week:  "2026-10-12",
+			title: "Keep it in rotation?",
+			body:  "You tried Lemon orzo. Make it a Regular?",
+			chatT: "Keep it in rotation? You tried Lemon orzo. Make it a Regular? Open MealQuest →",
+		},
+	} {
+		ev := tc.ev
+		if ev.Key != tc.key || ev.URL != tc.url || ev.Week.String() != tc.week || ev.Title != tc.title || ev.Body != tc.body {
+			t.Errorf("%s: event = %+v, want key %q url %q week %s title %q body %q", tc.name, ev, tc.key, tc.url, tc.week, tc.title, tc.body)
+		}
+		if got := Text(payloadOf(ev)); got != tc.chatT {
+			t.Errorf("%s: Text = %q, want %q", tc.name, got, tc.chatT)
+		}
+	}
+}
+
+func TestSupplyRunText(t *testing.T) {
+	t.Parallel()
+	got := SupplyRunText("Week 42 · Oct 12 – 18", []SupplyRunGroup{
+		{Dinner: "Tacos", Items: []SupplyRunItem{{Name: "ground beef", Qty: "1 lb"}, {Name: "tortillas"}}},
+		{Dinner: "Bolognese"},
+		{Dinner: "Pho", Items: []SupplyRunItem{{Name: "rice noodles", Qty: "200 g"}}},
+	})
+	want := "Supply run · Week 42 · Oct 12 – 18\n\n*Tacos*\n• ground beef — 1 lb\n• tortillas\n\n*Pho*\n• rice noodles — 200 g\n\nOpen the Supply run →"
+	if got != want {
+		t.Errorf("SupplyRunText =\n%s\nwant\n%s", got, want)
+	}
+	got = SupplyRunText("Cozy week", []SupplyRunGroup{{Dinner: "Tacos"}})
+	if want := "Supply run · Cozy week\n\nNothing left to buy.\n\nOpen the Supply run →"; got != want {
+		t.Errorf("SupplyRunText with nothing needed = %q, want %q", got, want)
+	}
+}
+
+func TestTextWithoutBody(t *testing.T) {
+	t.Parallel()
+	got := Text(notify.Payload{Event: notify.PlanReady, Title: "This week's plan is ready", URL: "/plan"})
+	if want := "This week's plan is ready. Open the plan →"; got != want {
+		t.Errorf("Text = %q, want %q", got, want)
+	}
+}
+
+func TestThreadKey(t *testing.T) {
+	t.Parallel()
+	for date, want := range map[string]string{
+		"2026-10-12": "mealquest-week-2026-W42",
+		"2026-12-28": "mealquest-week-2026-W53",
+		"2027-01-04": "mealquest-week-2027-W01",
+	} {
+		if got := ThreadKey(mustDate(t, date)); got != want {
+			t.Errorf("ThreadKey(%s) = %q, want %q", date, got, want)
+		}
+	}
+}

internal/chat/webhook.go

@@ -0,0 +1,115 @@
+package chat
+
+import (
+	"errors"
+	"fmt"
+	"net/url"
+	"regexp"
+	"strings"
+)
+
+const (
+	// webhookPrefix is how every accepted webhook URL starts, compared
+	// exactly: no other scheme, host spelling, port or user info.
+	webhookPrefix = "https://chat.googleapis.com/v1/spaces/"
+	// webhookHost is the only host a webhook URL may name.
+	webhookHost = "chat.googleapis.com"
+	// MaxWebhookURLLength bounds an accepted webhook URL.
+	MaxWebhookURLLength = 2048
+	// MinCredentialLength is the shortest key or token accepted, so the
+	// masked URL's token tail never gives away most of it.
+	MinCredentialLength = 16
+	// maskedTail is how many trailing characters of the token the masked
+	// URL shows.
+	maskedTail = 4
+)
+
+// webhookPath is the path of a space's incoming webhook; the group is the
+// space id.
+var webhookPath = regexp.MustCompile(`^/v1/spaces/([A-Za-z0-9_-]{1,128})/messages$`)
+
+// credentialChars is the alphabet of a decoded key or token: URL-safe
+// ASCII, so its length in bytes is its length in characters.
+var credentialChars = regexp.MustCompile(`^[A-Za-z0-9_.~=-]*$`)
+
+// Webhook is a validated Google Chat incoming webhook URL. Its String is
+// the full URL, a secret: it is only ever sealed for storage or sent to
+// Google Chat, never logged, shown or put in an error.
+type Webhook struct {
+	raw   string
+	space string
+	token string
+}
+
+// ParseWebhook validates raw as
+// https://chat.googleapis.com/v1/spaces/{space}/messages?key=…&token=…,
+// whose raw query is exactly key=…&token=…, in that order, each decoding to
+// at least MinCredentialLength characters of credentialChars. Its error
+// never quotes raw.
+func ParseWebhook(raw string) (Webhook, error) {
+	switch {
+	case raw == "":
+		return Webhook{}, errors.New("is required")
+	case len(raw) > MaxWebhookURLLength:
+		return Webhook{}, fmt.Errorf("must be at most %d characters", MaxWebhookURLLength)
+	case strings.ContainsFunc(raw, func(r rune) bool { return r <= ' ' || r == 0x7f }):
+		return Webhook{}, errors.New("must not contain spaces or control characters")
+	case !strings.HasPrefix(raw, webhookPrefix):
+		return Webhook{}, errors.New("must be a Google Chat incoming webhook URL starting with " + webhookPrefix)
+	case strings.Contains(raw, "#"):
+		return Webhook{}, errors.New("must not have a fragment")
+	}
+	u, err := url.Parse(raw)
+	if err != nil {
+		return Webhook{}, errors.New("is not a valid URL")
+	}
+	if u.Scheme != "https" || u.Host != webhookHost || u.User != nil || u.Opaque != "" || u.RawPath != "" {
+		return Webhook{}, errors.New("must be a Google Chat incoming webhook URL starting with " + webhookPrefix)
+	}
+	m := webhookPath.FindStringSubmatch(u.Path)
+	if m == nil {
+		return Webhook{}, errors.New("path must be /v1/spaces/{space}/messages")
+	}
+	// The raw query is exactly key=…&token=…: no empty segment, no second
+	// "?", no other or repeated parameter.
+	if strings.Contains(u.RawQuery, "?") {
+		return Webhook{}, errors.New("query must not contain ?")
+	}
+	segments := strings.Split(u.RawQuery, "&")
+	if len(segments) != 2 {
+		return Webhook{}, errors.New("query must be exactly key=…&token=…")
+	}
+	creds := make([]string, 2)
+	for i, name := range []string{"key", "token"} {
+		escaped, ok := strings.CutPrefix(segments[i], name+"=")
+		if !ok {
+			return Webhook{}, errors.New("query must be exactly key=…&token=…")
+		}
+		v, err := url.QueryUnescape(escaped)
+		if err != nil {
+			return Webhook{}, errors.New("query is not valid")
+		}
+		if !credentialChars.MatchString(v) {
+			return Webhook{}, fmt.Errorf("%s must be letters, digits, -, _, ., ~ or =", name)
+		}
+		if len(v) < MinCredentialLength {
+			return Webhook{}, fmt.Errorf("%s must be at least %d characters", name, MinCredentialLength)
+		}
+		creds[i] = v
+	}
+	return Webhook{raw: raw, space: m[1], token: creds[1]}, nil
+}
+
+// String returns the full webhook URL, a secret.
+func (w Webhook) String() string {
+	return w.raw
+}
+
+// Masked returns the URL with its key hidden and only the last few
+// characters of its token, such as
+// "https://chat.googleapis.com/v1/spaces/AAQA1234/messages?key=…&token=…x3Dk".
+func (w Webhook) Masked() string {
+	// The token is ASCII of at least MinCredentialLength bytes, so the
+	// tail is maskedTail of its many characters.
+	return webhookPrefix + w.space + "/messages?key=…&token=…" + w.token[len(w.token)-maskedTail:]
+}

internal/chat/webhook_test.go

@@ -0,0 +1,101 @@
+package chat
+
+import (
+	"strings"
+	"testing"
+)
+
+const (
+	testKey   = "AIzaSyDdI0hCZtE6vySjMm-WEfRq3CPzqKqqsHI"
+	testToken = "q0Lz3kV9Yw8pXcRtN2bHsJdFgA7uEmKiOlP1nZxQ%3D"
+	testSpace = "AAQA1b2C3d4"
+	testHook  = "https://chat.googleapis.com/v1/spaces/" + testSpace + "/messages?key=" + testKey + "&token=" + testToken
+)
+
+func TestParseWebhookAccepts(t *testing.T) {
+	t.Parallel()
+	for _, raw := range []string{
+		testHook,
+		"https://chat.googleapis.com/v1/spaces/AAAA_x-y/messages?key=" + testKey + "&token=" + testToken,
+	} {
+		hook, err := ParseWebhook(raw)
+		if err != nil {
+			t.Errorf("ParseWebhook(%q) = %v, want accepted", raw, err)
+			continue
+		}
+		if hook.String() != raw {
+			t.Errorf("String() = %q, want %q", hook.String(), raw)
+		}
+	}
+}
+
+func TestParseWebhookRejects(t *testing.T) {
+	t.Parallel()
+	q := "?key=" + testKey + "&token=" + testToken
+	for name, raw := range map[string]string{
+		"empty":               "",
+		"http":                "http://chat.googleapis.com/v1/spaces/" + testSpace + "/messages" + q,
+		"upper-case scheme":   "HTTPS://chat.googleapis.com/v1/spaces/" + testSpace + "/messages" + q,
+		"lookalike suffix":    "https://chat.googleapis.com.evil.example/v1/spaces/" + testSpace + "/messages" + q,
+		"lookalike prefix":    "https://evilchat.googleapis.com/v1/spaces/" + testSpace + "/messages" + q,
+		"other google host":   "https://www.googleapis.com/v1/spaces/" + testSpace + "/messages" + q,
+		"upper-case host":     "https://CHAT.googleapis.com/v1/spaces/" + testSpace + "/messages" + q,
+		"port":                "https://chat.googleapis.com:443/v1/spaces/" + testSpace + "/messages" + q,
+		"user info":           "https://user@chat.googleapis.com/v1/spaces/" + testSpace + "/messages" + q,
+		"trailing dot host":   "https://chat.googleapis.com./v1/spaces/" + testSpace + "/messages" + q,
+		"no space":            "https://chat.googleapis.com/v1/spaces//messages" + q,
+		"extra path":          "https://chat.googleapis.com/v1/spaces/" + testSpace + "/messages/x" + q,
+		"other version":       "https://chat.googleapis.com/v2/spaces/" + testSpace + "/messages" + q,
+		"members path":        "https://chat.googleapis.com/v1/spaces/" + testSpace + "/members" + q,
+		"escaped path":        "https://chat.googleapis.com/v1/spaces/AA%2FQA/messages" + q,
+		"dot segment":         "https://chat.googleapis.com/v1/spaces/../messages" + q,
+		"no query":            "https://chat.googleapis.com/v1/spaces/" + testSpace + "/messages",
+		"no key":              "https://chat.googleapis.com/v1/spaces/" + testSpace + "/messages?token=" + testToken,
+		"no token":            "https://chat.googleapis.com/v1/spaces/" + testSpace + "/messages?key=" + testKey,
+		"empty token":         "https://chat.googleapis.com/v1/spaces/" + testSpace + "/messages?key=" + testKey + "&token=",
+		"short key":           "https://chat.googleapis.com/v1/spaces/" + testSpace + "/messages?key=abc&token=" + testToken,
+		"token first":         "https://chat.googleapis.com/v1/spaces/" + testSpace + "/messages?token=" + testToken + "&key=" + testKey,
+		"empty segment":       "https://chat.googleapis.com/v1/spaces/" + testSpace + "/messages?key=" + testKey + "&&token=" + testToken,
+		"leading ampersand":   "https://chat.googleapis.com/v1/spaces/" + testSpace + "/messages?&" + q[1:],
+		"trailing ampersand":  "https://chat.googleapis.com/v1/spaces/" + testSpace + "/messages" + q + "&",
+		"second question":     "https://chat.googleapis.com/v1/spaces/" + testSpace + "/messages" + q + "?x",
+		"multi-byte token":    "https://chat.googleapis.com/v1/spaces/" + testSpace + "/messages?key=" + testKey + "&token=" + strings.Repeat("%F0%9F%98%80", 4),
+		"multi-byte key":      "https://chat.googleapis.com/v1/spaces/" + testSpace + "/messages?key=" + strings.Repeat("%F0%9F%98%80", 4) + "&token=" + testToken,
+		"plus in token":       "https://chat.googleapis.com/v1/spaces/" + testSpace + "/messages?key=" + testKey + "&token=" + testToken + "+",
+		"repeated key":        "https://chat.googleapis.com/v1/spaces/" + testSpace + "/messages" + q + "&key=" + testKey,
+		"extra parameter":     "https://chat.googleapis.com/v1/spaces/" + testSpace + "/messages" + q + "&threadKey=x",
+		"bad escape in query": "https://chat.googleapis.com/v1/spaces/" + testSpace + "/messages" + q + "%zz",
+		"fragment":            testHook + "#frag",
+		"space":               testHook + " ",
+		"newline":             testHook + "\n",
+		"too long":            testHook + strings.Repeat("A", MaxWebhookURLLength),
+		"not a URL":           "chat webhook please",
+	} {
+		_, err := ParseWebhook(raw)
+		if err == nil {
+			t.Errorf("%s: ParseWebhook(%q) accepted", name, raw)
+			continue
+		}
+		for _, secret := range []string{testKey, testToken, testSpace} {
+			if strings.Contains(err.Error(), secret) {
+				t.Errorf("%s: error %q quotes the URL", name, err)
+			}
+		}
+	}
+}
+
+func TestWebhookMasked(t *testing.T) {
+	t.Parallel()
+	hook, err := ParseWebhook(testHook)
+	if err != nil {
+		t.Fatal(err)
+	}
+	// The tail is of the token as it decodes: "%3D" is "=".
+	want := "https://chat.googleapis.com/v1/spaces/" + testSpace + "/messages?key=…&token=…ZxQ="
+	if got := hook.Masked(); got != want {
+		t.Errorf("Masked() = %q, want %q", got, want)
+	}
+	if m := hook.Masked(); strings.Contains(m, testKey) || strings.Contains(m, testToken) || strings.Contains(m, testToken[:8]) {
+		t.Errorf("Masked() = %q holds the key or token", m)
+	}
+}