Phase 8: level-2 differentiated rate limits (spec 7.4)

The journal-milter, until now a pure monitor, now refuses a message with a
4xx tempfail (RespTempFail/451) at MAIL FROM when a per-domain or per-
application limit is exceeded. Key is the client IP; the count is
COUNT(DISTINCT queue_id) over a sliding window reusing the send log; the
limit applies only when a non-empty IP binding matches the client (empty
binding => level-1 only, per spec 7.4). Enforcement is fail-open on the
milter's own errors — a limiter malfunction never blocks mail, and Postfix's
level-1 anvil limit stays the independent backstop. Refused messages are
recorded in send_log with status "rejected" for UI visibility.

- store/ratelimits.go: RateLimit type (+Active/AllowsIP), id-keyed get/set/
  delete for the panel, name/login-keyed lookup + windowed distinct-message
  count for the milter, DeleteRateLimitsForDomain. No migration — the
  rate_limits table has existed since Phase 2.
- milter: enforce at MailFrom, fail-open helper overLimit, InsertRejected.
- web: server-side validated IP/ceiling/window forms on the domain page and
  per application; routes POST /domains/{id}/ratelimit and
  /applications/{aid}/ratelimit. Milter reads rows live, so no reload.
- domain/app services clear limits on deletion (rate_limits has no FK cascade).

Unit tests + container e2e (p8) green: refusal on both scopes, unregistered
IP ignored, fail-open with the panel stopped.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/web/handlers_apps.go

@@ -27,6 +27,20 @@ type detailView struct {
 	FormMode  string
 	FormAddrs string
 	NewCred   *newCred
+	// RateLimitErr surfaces a validation error from a domain- or application-level
+	// rate-limit form (spec 7.4) as a page banner.
+	RateLimitErr string
+}
+
+// appRateLimitView pairs an application with its differentiated rate-limit
+// settings for the domain page. store.Application is embedded so the existing
+// template fields (Login, AddressMode, Addresses, ID) resolve unchanged.
+type appRateLimitView struct {
+	store.Application
+	HasLimit  bool   // an active limit is configured
+	IPsText   string // allowed IPs, newline-joined for the textarea
+	MaxText   string // message ceiling, blank when unset
+	WindowVal string // window seconds, defaulted when unset
 }
 
 // handleDomainDetail shows a single domain: its DKIM DNS record (spec 7.2.10)
@@ -56,23 +70,70 @@ func (s *Server) renderDomainDetail(w http.ResponseWriter, r *http.Request, stat
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
 	}
+	appViews := make([]appRateLimitView, 0, len(apps))
+	for _, a := range apps {
+		rl, ok, err := s.apps.RateLimit(a.ID)
+		if err != nil {
+			logf("panel: application %d: rate limit: %v", a.ID, err)
+			http.Error(w, "internal error", http.StatusInternalServerError)
+			return
+		}
+		appViews = append(appViews, appRateLimitView{
+			Application: a,
+			HasLimit:    ok && rl.Active(),
+			IPsText:     strings.Join(rl.AllowedIPs, "\n"),
+			MaxText:     intOrBlank(rl.MaxMessages),
+			WindowVal:   windowOrDefault(rl.WindowSeconds),
+		})
+	}
+
+	domainRL, domainRLok, err := s.domains.RateLimit(d.ID)
+	if err != nil {
+		logf("panel: domain %d: rate limit: %v", d.ID, err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+
 	s.render(w, status, "domain_detail", map[string]any{
-		"Title":     "SelfPost — " + d.Name,
-		"User":      currentUser(r),
-		"Domain":    d,
-		"Record":    record,
-		"Apps":      apps,
-		"Error":     view.FormErr,
-		"FormLogin": view.FormLogin,
-		"FormMode":  view.FormMode,
-		"FormAddrs": view.FormAddrs,
-		"NewCred":   view.NewCred,
-		"Flash":     detailFlash(r),
-		"Wildcard":  store.AddressModeWildcard,
-		"List":      store.AddressModeList,
+		"Title":        "SelfPost — " + d.Name,
+		"User":         currentUser(r),
+		"Domain":       d,
+		"Record":       record,
+		"Apps":         appViews,
+		"Error":        view.FormErr,
+		"FormLogin":    view.FormLogin,
+		"FormMode":     view.FormMode,
+		"FormAddrs":    view.FormAddrs,
+		"NewCred":      view.NewCred,
+		"Flash":        detailFlash(r),
+		"Wildcard":     store.AddressModeWildcard,
+		"List":         store.AddressModeList,
+		"RateLimitErr": view.RateLimitErr,
+		"DomainHasRL":  domainRLok && domainRL.Active(),
+		"DomainRLIPs":  strings.Join(domainRL.AllowedIPs, "\n"),
+		"DomainRLMax":  intOrBlank(domainRL.MaxMessages),
+		"DomainRLWin":  windowOrDefault(domainRL.WindowSeconds),
 	})
 }
 
+// intOrBlank renders a non-positive number as an empty string so an unset field
+// shows blank rather than "0".
+func intOrBlank(n int) string {
+	if n <= 0 {
+		return ""
+	}
+	return strconv.Itoa(n)
+}
+
+// windowOrDefault renders the window seconds, substituting the default when
+// unset so the form always suggests a sensible value.
+func windowOrDefault(n int) string {
+	if n <= 0 {
+		return strconv.Itoa(defaultRateLimitWindowSeconds)
+	}
+	return strconv.Itoa(n)
+}
+
 // detailFlash maps a fixed redirect flag to a fixed message, so status text
 // after a redirect is never attacker-influenced.
 func detailFlash(r *http.Request) string {
@@ -81,6 +142,8 @@ func detailFlash(r *http.Request) string {
 		return "Application deleted."
 	case r.URL.Query().Get("modeupdated") != "":
 		return "Application address mode updated."
+	case r.URL.Query().Get("ratelimit") != "":
+		return "Rate limit updated."
 	default:
 		return ""
 	}

internal/web/handlers_ratelimit.go

@@ -0,0 +1,155 @@
+package web
+
+import (
+	"fmt"
+	"net"
+	"net/http"
+	"strconv"
+	"strings"
+
+	"codeberg.org/mix/selfpost/internal/store"
+)
+
+// defaultRateLimitWindowSeconds is the sliding-window length used when an admin
+// sets a message ceiling but leaves the window blank (spec 7.4, matching the
+// level-1 default hour, spec 8: RATE_LIMIT_WINDOW_SECONDS).
+const defaultRateLimitWindowSeconds = 3600
+
+// rateLimitInput is the validated result of a rate-limit form submission. clear
+// means "remove the differentiated limit" (spec 7.4: an empty IP binding leaves
+// only level 1).
+type rateLimitInput struct {
+	clear         bool
+	ips           []string
+	maxMessages   int
+	windowSeconds int
+}
+
+// parseRateLimitForm validates a rate-limit submission on the server (spec
+// 7.6.2). It returns clear=true when the admin removes the limit or leaves the
+// IP binding empty; otherwise it requires a positive ceiling and window. The
+// returned error's message is safe to show to the admin.
+func parseRateLimitForm(r *http.Request) (rateLimitInput, error) {
+	if err := r.ParseForm(); err != nil {
+		return rateLimitInput{}, fmt.Errorf("invalid form submission")
+	}
+	if r.PostFormValue("clear") != "" {
+		return rateLimitInput{clear: true}, nil
+	}
+	ips, err := parseIPList(r.PostFormValue("allowed_ips"))
+	if err != nil {
+		return rateLimitInput{}, err
+	}
+	if len(ips) == 0 {
+		// No IP binding: the differentiated limit does not apply (spec 7.4).
+		return rateLimitInput{clear: true}, nil
+	}
+	maxMessages, err := parsePositiveInt(r.PostFormValue("max_messages"), 0)
+	if err != nil || maxMessages <= 0 {
+		return rateLimitInput{}, fmt.Errorf("enter a message limit greater than zero")
+	}
+	windowSeconds, err := parsePositiveInt(r.PostFormValue("window_seconds"), defaultRateLimitWindowSeconds)
+	if err != nil || windowSeconds <= 0 {
+		return rateLimitInput{}, fmt.Errorf("enter a time window greater than zero seconds")
+	}
+	return rateLimitInput{ips: ips, maxMessages: maxMessages, windowSeconds: windowSeconds}, nil
+}
+
+// parseIPList parses the allowed-IP field (IPs separated by newlines, commas or
+// whitespace) into a deduplicated list of canonical addresses, rejecting any
+// token that is not a valid IP (spec 7.6.2). The values are only ever stored as
+// SQLite parameters and compared in the milter, never written to a config file.
+func parseIPList(raw string) ([]string, error) {
+	fields := strings.FieldsFunc(raw, func(r rune) bool {
+		return r == '\n' || r == '\r' || r == ',' || r == ' ' || r == '\t' || r == ';'
+	})
+	var out []string
+	seen := make(map[string]bool)
+	for _, f := range fields {
+		ip := net.ParseIP(f)
+		if ip == nil {
+			return nil, fmt.Errorf("%q is not a valid IP address", f)
+		}
+		c := ip.String()
+		if !seen[c] {
+			seen[c] = true
+			out = append(out, c)
+		}
+	}
+	return out, nil
+}
+
+// parsePositiveInt parses a trimmed integer field, returning def when it is
+// blank. A non-numeric value returns an error.
+func parsePositiveInt(raw string, def int) (int, error) {
+	raw = strings.TrimSpace(raw)
+	if raw == "" {
+		return def, nil
+	}
+	return strconv.Atoi(raw)
+}
+
+// handleDomainRateLimit saves or clears a domain-level differentiated rate limit
+// (spec 7.4). No reload is needed — the milter reads the row live.
+func (s *Server) handleDomainRateLimit(w http.ResponseWriter, r *http.Request) {
+	d, ok := s.lookupDomain(w, r)
+	if !ok {
+		return
+	}
+	in, err := parseRateLimitForm(r)
+	if err != nil {
+		s.renderDomainDetail(w, r, http.StatusBadRequest, d, detailView{
+			FormMode:     store.AddressModeWildcard,
+			RateLimitErr: err.Error(),
+		})
+		return
+	}
+	if err := s.applyRateLimit(in, s.domains.SaveRateLimit, s.domains.ClearRateLimit, d.ID); err != nil {
+		logf("panel: domain %d: save rate limit: %v", d.ID, err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	http.Redirect(w, r, fmt.Sprintf("/domains/%d?ratelimit=1", d.ID), http.StatusSeeOther)
+}
+
+// handleAppRateLimit saves or clears an application-level differentiated rate
+// limit (spec 7.4).
+func (s *Server) handleAppRateLimit(w http.ResponseWriter, r *http.Request) {
+	a, ok := s.lookupApplication(w, r)
+	if !ok {
+		return
+	}
+	d, err := s.domains.Get(a.DomainID)
+	if err != nil {
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	in, err := parseRateLimitForm(r)
+	if err != nil {
+		s.renderDomainDetail(w, r, http.StatusBadRequest, d, detailView{
+			FormMode:     store.AddressModeWildcard,
+			RateLimitErr: fmt.Sprintf("%s: %s", a.Login, err.Error()),
+		})
+		return
+	}
+	if err := s.applyRateLimit(in, s.apps.SaveRateLimit, s.apps.ClearRateLimit, a.ID); err != nil {
+		logf("panel: application %d: save rate limit: %v", a.ID, err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	http.Redirect(w, r, fmt.Sprintf("/domains/%d?ratelimit=1", a.DomainID), http.StatusSeeOther)
+}
+
+// applyRateLimit dispatches a validated input to the save or clear method of the
+// relevant service, keyed by the domain or application id.
+func (s *Server) applyRateLimit(
+	in rateLimitInput,
+	save func(id int64, ips []string, maxMessages, windowSeconds int) error,
+	clear func(id int64) error,
+	id int64,
+) error {
+	if in.clear {
+		return clear(id)
+	}
+	return save(id, in.ips, in.maxMessages, in.windowSeconds)
+}

internal/web/templates/domain_detail.html

@@ -12,6 +12,7 @@
 <a class="back" href="/">&larr; All domains</a>
 
 {{if .Flash}}<div class="flash">{{.Flash}}</div>{{end}}
+{{if .RateLimitErr}}<div class="flash error">{{.RateLimitErr}}</div>{{end}}
 
 {{if .NewCred}}
 <div class="card credential">
@@ -79,6 +80,25 @@
               <button type="submit">Save mode</button>
             </form>
           </details>
+          <details>
+            <summary>Rate limit{{if .HasLimit}} (active){{end}}</summary>
+            <form method="post" action="/applications/{{.ID}}/ratelimit">
+              <label>Expected client IPs (one per line or comma-separated)</label>
+              <textarea name="allowed_ips" rows="2" placeholder="203.0.113.10">{{.IPsText}}</textarea>
+              <label>Message limit</label>
+              <input name="max_messages" type="number" min="1" value="{{.MaxText}}" placeholder="500">
+              <label>Window (seconds)</label>
+              <input name="window_seconds" type="number" min="1" value="{{.WindowVal}}">
+              <button type="submit">Save limit</button>
+            </form>
+            {{if .HasLimit}}
+            <form class="inline" method="post" action="/applications/{{.ID}}/ratelimit"
+                  onsubmit="return confirm('Remove the rate limit for {{.Login}}? Only the global level-1 limit will apply.')">
+              <input type="hidden" name="clear" value="1">
+              <button type="submit" class="danger">Remove limit</button>
+            </form>
+            {{end}}
+          </details>
           <form class="inline" method="post" action="/applications/{{.ID}}/password"
                 onsubmit="return confirm('Regenerate the password for {{.Login}}? The current password stops working immediately.')">
             <button type="submit">New password</button>
@@ -97,6 +117,41 @@
   {{end}}
 </div>
 
+<div class="card">
+  <h2>Sending rate limit (domain)</h2>
+  <p class="muted">Optional level-2 limit (spec 7.4): cap how many messages this
+  domain may send from its expected client IP(s) within a time window, summed
+  across all its applications. It counts messages — one message to many
+  recipients counts once. Leave the IP list empty to disable it and rely only on
+  the global level-1 limit. Applications that send from changing IPs should be
+  left unbound here.</p>
+
+  <p class="muted">Status:
+    {{if .DomainHasRL}}<strong>active</strong>{{else}}inactive (level-1 only){{end}}.</p>
+
+  <form method="post" action="/domains/{{.Domain.ID}}/ratelimit">
+    <label for="d_ips">Expected client IPs (one per line or comma-separated)</label>
+    <textarea id="d_ips" name="allowed_ips" rows="2"
+              placeholder="203.0.113.10">{{.DomainRLIPs}}</textarea>
+
+    <label for="d_max">Message limit</label>
+    <input id="d_max" name="max_messages" type="number" min="1"
+           value="{{.DomainRLMax}}" placeholder="1000">
+
+    <label for="d_win">Window (seconds)</label>
+    <input id="d_win" name="window_seconds" type="number" min="1" value="{{.DomainRLWin}}">
+
+    <button type="submit">Save limit</button>
+  </form>
+  {{if .DomainHasRL}}
+  <form class="inline" method="post" action="/domains/{{.Domain.ID}}/ratelimit"
+        onsubmit="return confirm('Remove the domain rate limit? Only the global level-1 limit will apply.')">
+    <input type="hidden" name="clear" value="1">
+    <button type="submit" class="danger">Remove limit</button>
+  </form>
+  {{end}}
+</div>
+
 <div class="card">
   <h2>Add an application</h2>
   <form method="post" action="/domains/{{.Domain.ID}}/applications">

internal/web/web.go

@@ -106,8 +106,10 @@ func (s *Server) Handler() http.Handler {
 	authed.HandleFunc("GET /domains/{id}/delete", s.handleDeleteConfirm)
 	authed.HandleFunc("POST /domains/{id}/delete", s.handleDeleteDomain)
 	authed.HandleFunc("POST /domains/{id}/applications", s.handleAddApplication)
+	authed.HandleFunc("POST /domains/{id}/ratelimit", s.handleDomainRateLimit)
 	authed.HandleFunc("POST /applications/{aid}/mode", s.handleUpdateAppMode)
 	authed.HandleFunc("POST /applications/{aid}/password", s.handleRegenPassword)
+	authed.HandleFunc("POST /applications/{aid}/ratelimit", s.handleAppRateLimit)
 	authed.HandleFunc("POST /applications/{aid}/delete", s.handleDeleteApplication)
 	authed.HandleFunc("POST /reload", s.handleReload)