feat(panel): add domain-admin role with per-domain authorization

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-08-10 23:43:59 +03:00
parent c9076655b9
commit 15baa1e5d0
28 changed files with 1425 additions and 333 deletions
@@ -1,85 +0,0 @@
-package store
-
-import (
-	"database/sql"
-	"errors"
-	"fmt"
-	"time"
-)
-
-// ErrNoAdmin is returned by GetAdmin when primary setup has not happened yet.
-var ErrNoAdmin = errors.New("no administrator account")
-
-// Admin is the single panel administrator (security.md).
-type Admin struct {
-	Username         string
-	PasswordHash     string
-	DMARCReportEmail string // default rua= for all sending domains; empty = none
-	CreatedAt        time.Time
-}
-
-// AdminExists reports whether the administrator account has been created. This
-// doubles as the "primary setup complete" flag: once true, the /setup route is
-// permanently gone (security.md).
-func (s *Store) AdminExists() (bool, error) {
-	var n int
-	if err := s.db.QueryRow("SELECT COUNT(*) FROM admin").Scan(&n); err != nil {
-		return false, fmt.Errorf("count admin: %w", err)
-	}
-	return n > 0, nil
-}
-
-// CreateAdmin inserts the administrator row. It fails if one already exists,
-// which — combined with the id=1 constraint — makes admin creation one-shot
-// even under a race between two setup submissions.
-func (s *Store) CreateAdmin(username, passwordHash string) error {
-	_, err := s.db.Exec(
-		"INSERT INTO admin (id, username, password_hash, created_at) VALUES (1, ?, ?, ?)",
-		username, passwordHash, time.Now().UTC().Format(time.RFC3339),
-	)
-	if err != nil {
-		return fmt.Errorf("create admin: %w", err)
-	}
-	return nil
-}
-
-// UpdateAdmin replaces the administrator's username and password hash. It
-// touches only the admin row (id = 1): panel credentials are unrelated to the
-// SASL logins applications authenticate with, which live in their own table.
-// ErrNoAdmin is returned if setup has not happened yet, so a change can never
-// silently create an account.
-func (s *Store) UpdateAdmin(username, passwordHash, dmarcReportEmail string) error {
-	res, err := s.db.Exec(
-		"UPDATE admin SET username = ?, password_hash = ?, dmarc_report_email = ? WHERE id = 1",
-		username, passwordHash, dmarcReportEmail,
-	)
-	if err != nil {
-		return fmt.Errorf("update admin: %w", err)
-	}
-	n, err := res.RowsAffected()
-	if err != nil {
-		return fmt.Errorf("update admin: %w", err)
-	}
-	if n == 0 {
-		return ErrNoAdmin
-	}
-	return nil
-}
-
-// GetAdmin returns the administrator account, or ErrNoAdmin if setup is pending.
-func (s *Store) GetAdmin() (Admin, error) {
-	var (
-		a         Admin
-		createdAt string
-	)
-	err := s.db.QueryRow("SELECT username, password_hash, dmarc_report_email, created_at FROM admin WHERE id = 1").
-		Scan(&a.Username, &a.PasswordHash, &a.DMARCReportEmail, &createdAt)
-	if errors.Is(err, sql.ErrNoRows) {
-		return Admin{}, ErrNoAdmin
-	}
-	if err != nil {
-		return Admin{}, fmt.Errorf("get admin: %w", err)
-	}
-	a.CreatedAt, _ = time.Parse(time.RFC3339, createdAt)
-	return a, nil
-}
@@ -1,56 +0,0 @@
-package store
-
-import (
-	"errors"
-	"testing"
-)
-
-func TestUpdateAdmin(t *testing.T) {
-	st := openTestStore(t)
-
-	if err := st.CreateAdmin("admin", "hash-one"); err != nil {
-		t.Fatalf("CreateAdmin: %v", err)
-	}
-	if err := st.UpdateAdmin("operator", "hash-two", "reports@hub.example"); err != nil {
-		t.Fatalf("UpdateAdmin: %v", err)
-	}
-
-	a, err := st.GetAdmin()
-	if err != nil {
-		t.Fatalf("GetAdmin: %v", err)
-	}
-	if a.DMARCReportEmail != "reports@hub.example" {
-		t.Fatalf("dmarc email = %q", a.DMARCReportEmail)
-	}
-
-	if err := st.UpdateAdmin("operator", "hash-three", ""); err != nil {
-		t.Fatalf("clear dmarc email: %v", err)
-	}
-	a, err = st.GetAdmin()
-	if err != nil {
-		t.Fatalf("GetAdmin: %v", err)
-	}
-	if a.Username != "operator" || a.PasswordHash != "hash-three" {
-		t.Fatalf("unexpected admin after update: %+v", a)
-	}
-	if a.CreatedAt.IsZero() {
-		t.Fatal("update dropped created_at")
-	}
-}
-
-// An update before setup must not create the account: only the one-time setup
-// flow may do that (security.md).
-func TestUpdateAdminWithoutAdmin(t *testing.T) {
-	st := openTestStore(t)
-
-	if err := st.UpdateAdmin("operator", "hash", ""); !errors.Is(err, ErrNoAdmin) {
-		t.Fatalf("UpdateAdmin without admin = %v, want ErrNoAdmin", err)
-	}
-	exists, err := st.AdminExists()
-	if err != nil {
-		t.Fatalf("AdminExists: %v", err)
-	}
-	if exists {
-		t.Fatal("UpdateAdmin created an administrator")
-	}
-}
@@ -0,0 +1,26 @@
+-- Panel users and domain-admin assignments. Migrates the single admin row into
+-- a global user; drops the admin table.
+
+CREATE TABLE users (
+    id                  INTEGER PRIMARY KEY AUTOINCREMENT,
+    username            TEXT NOT NULL UNIQUE,
+    password_hash       TEXT NOT NULL,
+    role                TEXT NOT NULL CHECK (role IN ('global', 'domain_admin')),
+    dmarc_report_email  TEXT NOT NULL DEFAULT '',
+    created_at          TEXT NOT NULL
+);
+
+CREATE TABLE user_domains (
+    user_id   INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    domain_id INTEGER NOT NULL REFERENCES domains(id) ON DELETE CASCADE,
+    PRIMARY KEY (user_id, domain_id)
+);
+
+INSERT INTO users (username, password_hash, role, dmarc_report_email, created_at)
+SELECT username, password_hash, 'global', dmarc_report_email, created_at
+FROM admin WHERE id = 1;
+
+INSERT OR REPLACE INTO settings (key, value)
+SELECT 'dmarc_report_email', dmarc_report_email FROM admin WHERE id = 1;
+
+DROP TABLE admin;
@@ -0,0 +1,32 @@
+package store
+
+import (
+	"database/sql"
+	"errors"
+	"fmt"
+)
+
+// GetSetting returns a settings value or empty string when missing.
+func (s *Store) GetSetting(key string) (string, error) {
+	var value string
+	err := s.db.QueryRow("SELECT value FROM settings WHERE key = ?", key).Scan(&value)
+	if errors.Is(err, sql.ErrNoRows) {
+		return "", nil
+	}
+	if err != nil {
+		return "", fmt.Errorf("get setting %s: %w", key, err)
+	}
+	return value, nil
+}
+
+// SetSetting upserts a settings key.
+func (s *Store) SetSetting(key, value string) error {
+	_, err := s.db.Exec(
+		"INSERT INTO settings (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value",
+		key, value,
+	)
+	if err != nil {
+		return fmt.Errorf("set setting %s: %w", key, err)
+	}
+	return nil
+}
@@ -0,0 +1,364 @@
+package store
+
+import (
+	"database/sql"
+	"errors"
+	"fmt"
+	"time"
+)
+
+// ErrNoUser is returned when primary setup has not happened yet.
+var ErrNoUser = errors.New("no panel user")
+
+// ErrUserNotFound is returned when a panel user id or username does not exist.
+var ErrUserNotFound = errors.New("user not found")
+
+// ErrUserExists is returned when a username is already taken.
+var ErrUserExists = errors.New("username already taken")
+
+// ErrLastGlobal is returned when deleting or demoting the last global user.
+var ErrLastGlobal = errors.New("cannot remove last global administrator")
+
+// Role identifies a panel user's access level.
+type Role string
+
+const (
+	RoleGlobal      Role = "global"
+	RoleDomainAdmin Role = "domain_admin"
+)
+
+// User is a panel login (not an application SASL account).
+type User struct {
+	ID               int64
+	Username         string
+	PasswordHash     string
+	Role             Role
+	DMARCReportEmail string
+	CreatedAt        time.Time
+	DomainIDs        []int64
+}
+
+// UserExists reports whether any panel user exists (setup complete).
+func (s *Store) UserExists() (bool, error) {
+	var n int
+	if err := s.db.QueryRow("SELECT COUNT(*) FROM users").Scan(&n); err != nil {
+		return false, fmt.Errorf("count users: %w", err)
+	}
+	return n > 0, nil
+}
+
+// CreateGlobalUser inserts the first global user during setup.
+func (s *Store) CreateGlobalUser(username, passwordHash string) error {
+	exists, err := s.UserExists()
+	if err != nil {
+		return err
+	}
+	if exists {
+		return fmt.Errorf("create global user: users already exist")
+	}
+	now := time.Now().UTC().Format(time.RFC3339)
+	_, err = s.db.Exec(
+		"INSERT INTO users (username, password_hash, role, dmarc_report_email, created_at) VALUES (?, ?, ?, '', ?)",
+		username, passwordHash, RoleGlobal, now,
+	)
+	if err != nil {
+		return fmt.Errorf("create global user: %w", err)
+	}
+	return nil
+}
+
+// GetUserByUsername returns a user with domain assignments loaded.
+func (s *Store) GetUserByUsername(username string) (User, error) {
+	var (
+		u         User
+		createdAt string
+	)
+	err := s.db.QueryRow(
+		"SELECT id, username, password_hash, role, dmarc_report_email, created_at FROM users WHERE username = ?",
+		username,
+	).Scan(&u.ID, &u.Username, &u.PasswordHash, &u.Role, &u.DMARCReportEmail, &createdAt)
+	if errors.Is(err, sql.ErrNoRows) {
+		return User{}, ErrUserNotFound
+	}
+	if err != nil {
+		return User{}, fmt.Errorf("get user by username: %w", err)
+	}
+	u.CreatedAt, _ = time.Parse(time.RFC3339, createdAt)
+	u.DomainIDs, err = s.listUserDomainIDs(u.ID)
+	if err != nil {
+		return User{}, err
+	}
+	return u, nil
+}
+
+// GetUser returns a user by id with domain assignments.
+func (s *Store) GetUser(id int64) (User, error) {
+	var (
+		u         User
+		createdAt string
+	)
+	err := s.db.QueryRow(
+		"SELECT id, username, password_hash, role, dmarc_report_email, created_at FROM users WHERE id = ?",
+		id,
+	).Scan(&u.ID, &u.Username, &u.PasswordHash, &u.Role, &u.DMARCReportEmail, &createdAt)
+	if errors.Is(err, sql.ErrNoRows) {
+		return User{}, ErrUserNotFound
+	}
+	if err != nil {
+		return User{}, fmt.Errorf("get user: %w", err)
+	}
+	u.CreatedAt, _ = time.Parse(time.RFC3339, createdAt)
+	u.DomainIDs, err = s.listUserDomainIDs(u.ID)
+	if err != nil {
+		return User{}, err
+	}
+	return u, nil
+}
+
+// ListUsers returns every panel user without domain ids.
+func (s *Store) ListUsers() ([]User, error) {
+	rows, err := s.db.Query(
+		"SELECT id, username, password_hash, role, dmarc_report_email, created_at FROM users ORDER BY id",
+	)
+	if err != nil {
+		return nil, fmt.Errorf("list users: %w", err)
+	}
+	defer rows.Close()
+	var users []User
+	for rows.Next() {
+		var (
+			u         User
+			createdAt string
+		)
+		if err := rows.Scan(&u.ID, &u.Username, &u.PasswordHash, &u.Role, &u.DMARCReportEmail, &createdAt); err != nil {
+			return nil, fmt.Errorf("list users scan: %w", err)
+		}
+		u.CreatedAt, _ = time.Parse(time.RFC3339, createdAt)
+		users = append(users, u)
+	}
+	return users, rows.Err()
+}
+
+// UserRow is a user plus assigned domain names for the management list.
+type UserRow struct {
+	User        User
+	DomainNames []string
+}
+
+// ListUserRows returns users with assigned domain names for the management UI.
+func (s *Store) ListUserRows() ([]UserRow, error) {
+	users, err := s.ListUsers()
+	if err != nil {
+		return nil, err
+	}
+	rows := make([]UserRow, len(users))
+	for i, u := range users {
+		rows[i].User = u
+		if u.Role == RoleGlobal {
+			continue
+		}
+		names, err := s.listUserDomainNames(u.ID)
+		if err != nil {
+			return nil, err
+		}
+		rows[i].DomainNames = names
+	}
+	return rows, nil
+}
+
+// CountGlobalUsers returns how many global-role users exist.
+func (s *Store) CountGlobalUsers() (int, error) {
+	var n int
+	if err := s.db.QueryRow("SELECT COUNT(*) FROM users WHERE role = ?", RoleGlobal).Scan(&n); err != nil {
+		return 0, fmt.Errorf("count global users: %w", err)
+	}
+	return n, nil
+}
+
+// CreateUser inserts a panel user and optional domain assignments.
+func (s *Store) CreateUser(username, passwordHash string, role Role, domainIDs []int64) (int64, error) {
+	if role == RoleDomainAdmin && len(domainIDs) == 0 {
+		return 0, fmt.Errorf("create user: domain_admin requires domains")
+	}
+	now := time.Now().UTC().Format(time.RFC3339)
+	res, err := s.db.Exec(
+		"INSERT INTO users (username, password_hash, role, dmarc_report_email, created_at) VALUES (?, ?, ?, '', ?)",
+		username, passwordHash, role, now,
+	)
+	if err != nil {
+		if isUniqueViolation(err) {
+			return 0, ErrUserExists
+		}
+		return 0, fmt.Errorf("create user: %w", err)
+	}
+	id, err := res.LastInsertId()
+	if err != nil {
+		return 0, fmt.Errorf("create user id: %w", err)
+	}
+	if role == RoleDomainAdmin {
+		if err := s.setUserDomains(id, domainIDs); err != nil {
+			return 0, err
+		}
+	}
+	return id, nil
+}
+
+// UpdateUser replaces username, password hash, and DMARC email for a user.
+func (s *Store) UpdateUser(id int64, username, passwordHash, dmarcReportEmail string) error {
+	u, err := s.GetUser(id)
+	if err != nil {
+		return err
+	}
+	res, err := s.db.Exec(
+		"UPDATE users SET username = ?, password_hash = ?, dmarc_report_email = ? WHERE id = ?",
+		username, passwordHash, dmarcReportEmail, id,
+	)
+	if err != nil {
+		if isUniqueViolation(err) {
+			return ErrUserExists
+		}
+		return fmt.Errorf("update user: %w", err)
+	}
+	n, err := res.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("update user: %w", err)
+	}
+	if n == 0 {
+		return ErrUserNotFound
+	}
+	if u.Role == RoleGlobal {
+		if err := s.SetSetting("dmarc_report_email", dmarcReportEmail); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// SetUserRole updates a user's role.
+func (s *Store) SetUserRole(userID int64, role Role) error {
+	res, err := s.db.Exec("UPDATE users SET role = ? WHERE id = ?", role, userID)
+	if err != nil {
+		return fmt.Errorf("set user role: %w", err)
+	}
+	n, err := res.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("set user role: %w", err)
+	}
+	if n == 0 {
+		return ErrUserNotFound
+	}
+	return nil
+}
+
+// ClearUserDomains removes all domain assignments for a user.
+func (s *Store) ClearUserDomains(userID int64) error {
+	_, err := s.db.Exec("DELETE FROM user_domains WHERE user_id = ?", userID)
+	if err != nil {
+		return fmt.Errorf("clear user domains: %w", err)
+	}
+	return nil
+}
+
+// SetUserDomains replaces domain assignments for a domain_admin user.
+func (s *Store) SetUserDomains(userID int64, domainIDs []int64) error {
+	u, err := s.GetUser(userID)
+	if err != nil {
+		return err
+	}
+	if u.Role != RoleDomainAdmin {
+		return fmt.Errorf("set user domains: user is not domain_admin")
+	}
+	if len(domainIDs) == 0 {
+		return fmt.Errorf("set user domains: at least one domain required")
+	}
+	return s.setUserDomains(userID, domainIDs)
+}
+
+// DeleteUser removes a panel user. ErrLastGlobal when deleting the only global user.
+func (s *Store) DeleteUser(id int64) error {
+	u, err := s.GetUser(id)
+	if err != nil {
+		return err
+	}
+	if u.Role == RoleGlobal {
+		n, err := s.CountGlobalUsers()
+		if err != nil {
+			return err
+		}
+		if n <= 1 {
+			return ErrLastGlobal
+		}
+	}
+	res, err := s.db.Exec("DELETE FROM users WHERE id = ?", id)
+	if err != nil {
+		return fmt.Errorf("delete user: %w", err)
+	}
+	n, err := res.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("delete user: %w", err)
+	}
+	if n == 0 {
+		return ErrUserNotFound
+	}
+	return nil
+}
+
+// GlobalDMARCReportEmail returns the shared default rua= for domain inherit mode.
+func (s *Store) GlobalDMARCReportEmail() (string, error) {
+	return s.GetSetting("dmarc_report_email")
+}
+
+func (s *Store) listUserDomainIDs(userID int64) ([]int64, error) {
+	rows, err := s.db.Query("SELECT domain_id FROM user_domains WHERE user_id = ? ORDER BY domain_id", userID)
+	if err != nil {
+		return nil, fmt.Errorf("list user domains: %w", err)
+	}
+	defer rows.Close()
+	var ids []int64
+	for rows.Next() {
+		var id int64
+		if err := rows.Scan(&id); err != nil {
+			return nil, fmt.Errorf("list user domains scan: %w", err)
+		}
+		ids = append(ids, id)
+	}
+	return ids, rows.Err()
+}
+
+func (s *Store) listUserDomainNames(userID int64) ([]string, error) {
+	rows, err := s.db.Query(
+		"SELECT d.name FROM user_domains ud JOIN domains d ON d.id = ud.domain_id WHERE ud.user_id = ? ORDER BY d.name",
+		userID,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("list user domain names: %w", err)
+	}
+	defer rows.Close()
+	var names []string
+	for rows.Next() {
+		var name string
+		if err := rows.Scan(&name); err != nil {
+			return nil, fmt.Errorf("list user domain names scan: %w", err)
+		}
+		names = append(names, name)
+	}
+	return names, rows.Err()
+}
+
+func (s *Store) setUserDomains(userID int64, domainIDs []int64) error {
+	tx, err := s.db.Begin()
+	if err != nil {
+		return fmt.Errorf("set user domains begin: %w", err)
+	}
+	if _, err := tx.Exec("DELETE FROM user_domains WHERE user_id = ?", userID); err != nil {
+		tx.Rollback()
+		return fmt.Errorf("set user domains clear: %w", err)
+	}
+	for _, did := range domainIDs {
+		if _, err := tx.Exec("INSERT INTO user_domains (user_id, domain_id) VALUES (?, ?)", userID, did); err != nil {
+			tx.Rollback()
+			return fmt.Errorf("set user domains insert: %w", err)
+		}
+	}
+	return tx.Commit()
+}
@@ -0,0 +1,101 @@
+package store
+
+import (
+	"errors"
+	"testing"
+)
+
+func TestUpdateUser(t *testing.T) {
+	st := openTestStore(t)
+
+	if err := st.CreateGlobalUser("admin", "hash-one"); err != nil {
+		t.Fatalf("CreateGlobalUser: %v", err)
+	}
+	u, err := st.GetUserByUsername("admin")
+	if err != nil {
+		t.Fatalf("GetUserByUsername: %v", err)
+	}
+	if err := st.UpdateUser(u.ID, "operator", "hash-two", "reports@hub.example"); err != nil {
+		t.Fatalf("UpdateUser: %v", err)
+	}
+
+	got, err := st.GetUser(u.ID)
+	if err != nil {
+		t.Fatalf("GetUser: %v", err)
+	}
+	if got.DMARCReportEmail != "reports@hub.example" {
+		t.Fatalf("dmarc email = %q", got.DMARCReportEmail)
+	}
+	email, err := st.GlobalDMARCReportEmail()
+	if err != nil {
+		t.Fatalf("GlobalDMARCReportEmail: %v", err)
+	}
+	if email != "reports@hub.example" {
+		t.Fatalf("settings dmarc = %q", email)
+	}
+
+	if err := st.UpdateUser(u.ID, "operator", "hash-three", ""); err != nil {
+		t.Fatalf("clear dmarc email: %v", err)
+	}
+	got, err = st.GetUser(u.ID)
+	if err != nil {
+		t.Fatalf("GetUser: %v", err)
+	}
+	if got.Username != "operator" || got.PasswordHash != "hash-three" {
+		t.Fatalf("unexpected user after update: %+v", got)
+	}
+	if got.CreatedAt.IsZero() {
+		t.Fatal("update dropped created_at")
+	}
+}
+
+func TestUpdateUserWithoutUser(t *testing.T) {
+	st := openTestStore(t)
+
+	if err := st.UpdateUser(1, "operator", "hash", ""); !errors.Is(err, ErrUserNotFound) {
+		t.Fatalf("UpdateUser without user = %v, want ErrUserNotFound", err)
+	}
+	exists, err := st.UserExists()
+	if err != nil {
+		t.Fatalf("UserExists: %v", err)
+	}
+	if exists {
+		t.Fatal("UpdateUser created a user")
+	}
+}
+
+func TestCreateDomainAdminUser(t *testing.T) {
+	st := openTestStore(t)
+	if err := st.CreateGlobalUser("admin", "hash"); err != nil {
+		t.Fatalf("CreateGlobalUser: %v", err)
+	}
+	d, err := st.AddDomain("example.com", "s1")
+	if err != nil {
+		t.Fatalf("AddDomain: %v", err)
+	}
+	id, err := st.CreateUser("domainop", "hash2", RoleDomainAdmin, []int64{d.ID})
+	if err != nil {
+		t.Fatalf("CreateUser: %v", err)
+	}
+	u, err := st.GetUser(id)
+	if err != nil {
+		t.Fatalf("GetUser: %v", err)
+	}
+	if len(u.DomainIDs) != 1 || u.DomainIDs[0] != d.ID {
+		t.Fatalf("domain ids = %v, want [%d]", u.DomainIDs, d.ID)
+	}
+}
+
+func TestDeleteLastGlobalUser(t *testing.T) {
+	st := openTestStore(t)
+	if err := st.CreateGlobalUser("admin", "hash"); err != nil {
+		t.Fatalf("CreateGlobalUser: %v", err)
+	}
+	u, err := st.GetUserByUsername("admin")
+	if err != nil {
+		t.Fatalf("GetUserByUsername: %v", err)
+	}
+	if err := st.DeleteUser(u.ID); !errors.Is(err, ErrLastGlobal) {
+		t.Fatalf("DeleteUser = %v, want ErrLastGlobal", err)
+	}
+}