release: 1.3.0: 1.3.0-1.3.1: security pass, queue persist, full backup layout

[1.3.0]
Security and quality after 1.2.5: domain-admin send-log authorization, fail-closed sign-in and application delete, level-2 rate-limit race fix, restore Resync, expanded tests, operator docs, release CI, and OFL for IBM Plex. Upgrading from 1.2.x is a tag bump; no migration.
Added:
  - licence: the SIL Open Font License 1.1 text now travels with the IBM Plex
  - docs: agreed roadmap item **queue-retries** — show this Postfix's retry
Security:
  - The independent security review of the send-log authorization and
Fixed:
  - test (e2e): send-log status scrapers follow the badge markup in
  - security (panel): the Deliveries list is scoped to a domain administrator's
  - mail (level-2 rate limit): the ceiling is no longer overshot by messages that
  - panel (sign-in): a session that cannot be written to the database no longer
  - panel (applications): deleting an application removes its SASL credentials
  … (2 more in CHANGELOG)
Changed:
  - docs: operator and as-built docs aligned with the code after a full
  - docs: [guide.md](docs/guide.md) reorganised into **Installation**, **Instance
  - docs: the 2026-08-13 full-tree review plan is complete — every phase (P0–P7)
  - licence: [NOTICE](NOTICE) tells modifiers to update `SourceURL` in
  - ci: the release image is published only for a **published** GitHub Release
  … (9 more in CHANGELOG)
[1.3.1]
Retry policy in the panel, persistent Postfix queue, and self-contained full backups. Mail queue and delivery history show this Postfix's first retry, backoff cap, and queue lifetime. Deferred mail survives container recreate. Full backups now archive `data/`, compose, `.env`, and `certs/`; the archive layout breaks 1.3.0 flat backups (unpack those with `tar xzf backup.tar.gz -C ./data` as before). Upgrading from 1.3.0 is a tag bump; no schema migration.
Added:
  - Mail queue and a delivery's history show this Postfix's retry policy
  - docs: **Plan checklists** in [development.md](docs/development.md) — format,
  - docs: **Implementation checklists** with model routing in
  - docs: roadmap candidates **send-log-retention** (panel Settings for delivery
  - Postfix queue under `/data/postfix/queue` — deferred and active mail survive
  … (1 more in CHANGELOG)
Changed:
  - **Breaking:** full-backup archive layout — paths are prefixed with `data/`;
  - docs: operator guide, architecture, security, and backup UI updated for
  - docs: HTML mockups for a full panel UI refresh
Changed:
  - docs: panel UI mockups after review — Status restored to live readings
  - docs: panel UI design system and mockups rebuilt as separate pages
  - docs: panel UI mockups — add-domain sits in the list card (Domains and
Fixed:
  - ci (GHCR): per-arch package tags (`X.Y.Z-amd64`, `X.Y.Z-arm64`) are dropped

Squashed CHANGELOG sections: [1.3.0], [1.3.1].

Full detail: CHANGELOG.md (1.3.0, 1.3.1).

internal/store/domains.go

@@ -75,6 +75,32 @@ func (s *Store) ListDomains() ([]Domain, error) {
 	return out, rows.Err()
 }
 
+// ListDomainsForUser returns domains assigned to userID with application counts,
+// ordered by name.
+func (s *Store) ListDomainsForUser(userID int64) ([]Domain, error) {
+	rows, err := s.db.Query(`
+		SELECT d.id, d.name, d.dkim_selector, d.dmarc_rua, d.created_at,
+		       (SELECT COUNT(*) FROM applications a WHERE a.domain_id = d.id)
+		FROM domains d
+		INNER JOIN user_domains ud ON ud.domain_id = d.id
+		WHERE ud.user_id = ?
+		ORDER BY d.name`, userID)
+	if err != nil {
+		return nil, fmt.Errorf("list domains for user: %w", err)
+	}
+	defer rows.Close()
+
+	var out []Domain
+	for rows.Next() {
+		d, err := scanDomain(rows)
+		if err != nil {
+			return nil, err
+		}
+		out = append(out, d)
+	}
+	return out, rows.Err()
+}
+
 // GetDomain returns a single domain (with its application count) by id, or
 // ErrDomainNotFound.
 func (s *Store) GetDomain(id int64) (Domain, error) {

internal/store/ratelimits_test.go

@@ -152,9 +152,9 @@ func TestDeleteRateLimitsForDomain(t *testing.T) {
 func TestRateLimitActiveAndAllowsIP(t *testing.T) {
 	inactive := []RateLimit{
 		{},
-		{Scope: RateLimitScopeDomain, AllowedIPs: []string{"203.0.113.1"}}, // no ceiling
-		{Scope: RateLimitScopeDomain, MaxMessages: 5},                      // no window
-		{Scope: RateLimitScopeApp, MaxMessages: 5, WindowSeconds: 60},      // app needs IPs
+		{Scope: RateLimitScopeDomain, AllowedIPs: []string{"203.0.113.1"}},              // no ceiling
+		{Scope: RateLimitScopeDomain, MaxMessages: 5},                                   // no window
+		{Scope: RateLimitScopeApp, MaxMessages: 5, WindowSeconds: 60},                   // app needs IPs
 		{Scope: RateLimitScopeApp, AllowedIPs: []string{"203.0.113.1"}, MaxMessages: 5}, // no window
 	}
 	for i, rl := range inactive {

internal/store/sendlog.go

@@ -178,15 +178,29 @@ func (s *Store) GetSendLog(id int64) (SendLogRow, error) {
 	return row, nil
 }
 
-// SendLogFilter narrows QuerySendLog/CountSendLog by domain and/or
-// application login. An empty field matches everything.
+// SendLogFilter narrows QuerySendLog/CountSendLog. It carries two kinds of
+// narrowing, and they behave in opposite ways on purpose.
+//
+// Domain and AppLogin are the operator's own filters, chosen in the UI: an
+// empty field matches everything.
+//
+// Domains and AllDomains are the authorization scope, which no query parameter
+// may widen. Domains is the exhaustive set of domain names the caller is
+// entitled to read, applied as an IN constraint; AllDomains lifts that
+// restriction and is the only way to read the whole journal. A zero-valued
+// filter therefore matches *no* rows: a caller that forgets to state a scope
+// gets an empty log rather than every tenant's mail, which is the failure mode
+// this struct exists to make impossible.
 type SendLogFilter struct {
-	Domain   string
-	AppLogin string
+	Domain     string
+	AppLogin   string
+	Domains    []string
+	AllDomains bool
 }
 
 // QuerySendLog returns send-log rows matching filter, newest first, for the
 // monitoring screen's server-side pagination (product.md's send-log view).
+// The filter's authorization scope is mandatory: see SendLogFilter.
 func (s *Store) QuerySendLog(filter SendLogFilter, limit, offset int) ([]SendLogRow, error) {
 	where, args := sendLogWhere(filter)
 	args = append(args, limit, offset)
@@ -233,6 +247,20 @@ func (s *Store) CountSendLog(filter SendLogFilter) (int64, error) {
 func sendLogWhere(f SendLogFilter) (string, []any) {
 	var clauses []string
 	var args []any
+	if !f.AllDomains {
+		// No scope is not "no restriction": a domain administrator whose last
+		// assignment was deleted owns nothing in the journal and must see
+		// nothing, and the same clause catches a caller that never set a scope.
+		if len(f.Domains) == 0 {
+			return " WHERE 1 = 0", nil
+		}
+		marks := make([]string, len(f.Domains))
+		for i, name := range f.Domains {
+			marks[i] = "?"
+			args = append(args, name)
+		}
+		clauses = append(clauses, "domain IN ("+strings.Join(marks, ", ")+")")
+	}
 	if f.Domain != "" {
 		clauses = append(clauses, "domain = ?")
 		args = append(args, f.Domain)

internal/store/sendlog_test.go

@@ -1,6 +1,8 @@
 package store
 
 import (
+	"sort"
+	"strings"
 	"testing"
 	"time"
 )
@@ -162,6 +164,61 @@ func TestUpdateStatusNoMatch(t *testing.T) {
 	}
 }
 
+// The journal is read by principals who are only entitled to part of it, so
+// the scope is part of the query rather than something the caller remembers to
+// apply afterwards. A filter that states no scope is a caller that has not
+// decided who is asking, and the safe answer to that is nothing.
+func TestSendLogScopeIsMandatory(t *testing.T) {
+	st := openTestStore(t)
+	for _, domain := range []string{"first.example.ru", "second.example.ru"} {
+		if err := st.InsertQueued(SendLogEntry{
+			QueueID: "Q-" + domain, Domain: domain, AppLogin: "app-" + domain,
+			From: "noreply@" + domain, To: "public@example.net", Subject: domain,
+		}); err != nil {
+			t.Fatalf("InsertQueued: %v", err)
+		}
+	}
+
+	for name, tc := range map[string]struct {
+		filter SendLogFilter
+		want   []string
+	}{
+		"no scope":           {SendLogFilter{}, nil},
+		"empty scope":        {SendLogFilter{Domains: []string{}}, nil},
+		"all domains":        {SendLogFilter{AllDomains: true}, []string{"first.example.ru", "second.example.ru"}},
+		"one domain":         {SendLogFilter{Domains: []string{"first.example.ru"}}, []string{"first.example.ru"}},
+		"two domains":        {SendLogFilter{Domains: []string{"first.example.ru", "second.example.ru"}}, []string{"first.example.ru", "second.example.ru"}},
+		"unknown domain":     {SendLogFilter{Domains: []string{"third.example.ru"}}, nil},
+		"filter within":      {SendLogFilter{Domain: "first.example.ru", Domains: []string{"first.example.ru", "second.example.ru"}}, []string{"first.example.ru"}},
+		"filter outside":     {SendLogFilter{Domain: "second.example.ru", Domains: []string{"first.example.ru"}}, nil},
+		"app filter outside": {SendLogFilter{AppLogin: "app-second.example.ru", Domains: []string{"first.example.ru"}}, nil},
+	} {
+		rows, err := st.QuerySendLog(tc.filter, 50, 0)
+		if err != nil {
+			t.Fatalf("%s: QuerySendLog: %v", name, err)
+		}
+		var got []string
+		for _, r := range rows {
+			got = append(got, r.Domain)
+		}
+		// Which rows came back is the question here; the page's own order is
+		// newest-first and is tested where it matters.
+		sort.Strings(got)
+		if strings.Join(got, ",") != strings.Join(tc.want, ",") {
+			t.Errorf("%s: rows for %v, want %v", name, got, tc.want)
+		}
+		// The count drives pagination, so it has to agree with the page or the
+		// UI advertises pages of rows the reader is not allowed to see.
+		n, err := st.CountSendLog(tc.filter)
+		if err != nil {
+			t.Fatalf("%s: CountSendLog: %v", name, err)
+		}
+		if int(n) != len(tc.want) {
+			t.Errorf("%s: count %d, want %d", name, n, len(tc.want))
+		}
+	}
+}
+
 func TestDeleteSendLogBefore(t *testing.T) {
 	st := openTestStore(t)
 

internal/store/store.go

@@ -1,7 +1,8 @@
 // Package store owns the SelfPost SQLite database: the single file under /data
-// that persists the administrator account, sending domains and applications,
-// the send log and rate-limit settings (architecture.md § Persistence). It
-// exposes typed queries so the rest of the panel never builds SQL by hand.
+// that persists panel users (global administrators and domain-admins), sending
+// domains and applications, the send log and rate-limit settings
+// (architecture.md § Persistence). It exposes typed queries so the rest of the
+// panel never builds SQL by hand.
 package store
 
 import (