panel-redesign: inbound is delegated per user, separately from outbound

Stage 1, step 2 (plan § Who sees what).

Store
  - Reach{AllDomains, DomainIDs, AllInbound, InboundDomainIDs} is what a
    domain user is assigned. CreateUser takes it; SetUserReach / ClearUserReach
    replace SetUserDomains / ClearUserDomains and write both directions in one
    transaction. A domain user with nothing on either list is refused
    (ErrEmptyReach). With All set the rows of that direction are not stored,
    so clearing All later brings nothing stale back.
  - ListDomainsForUser honours all_domains; ListInboundDomainsForUser is its
    inbound twin. Both filter in the query.

Authorization
  - auth.Principal carries the whole reach: CanAccessDomain (now also true
    with All), CanAccessInboundDomain, HasOutbound, HasInbound. An id or a
    name on one list opens nothing on the other.
  - Inbound handlers in three strengths: requireInbound (the list, filtered),
    requireInboundDomain (one domain: page, DNS re-check, upstream,
    recipients), requireInboundGlobal (add, delete confirm, delete). All
    answer the same 404.
  - domainIDSet and the DMARC report pages go through the principal instead
    of looking at p.Domains themselves.

Panel (old templates, until stage 2)
  - User form: two lists with All; inbound is offered only where the feature
    is on, and saving the form with it off keeps the user's inbound reach.
    Promotion to global drops the reach.
  - Menu: a group with nothing assigned is absent; / sends an inbound-only
    administrator to Inbound. The inbound pages hide add / delete from a
    domain administrator.

Tests: every route of one inbound domain against five kinds of refused
request (another tenant's id, a missing id, outbound-only reach, an outbound
domain with the same id, one with the same name, no principal) with the 404
bodies compared; add/delete as every non-global user; the filtered list
including a domain added later; thirteen outbound routes against another
tenant's domain and application id; the user form; the reach in the store;
the principal matrix; the menu; the home redirect. Removing the access check
or the query filter makes the tests fail (checked by hand).

go test ./...  green except the two Windows-only failures in internal/domain
and internal/logtail that predate this work.

Roadmap 12/27.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/store/domains.go

@@ -80,16 +80,18 @@ func (s *Store) ListDomains() ([]Domain, error) {
 	return out, rows.Err()
 }
 
-// ListDomainsForUser returns domains assigned to userID with application counts,
-// ordered by name.
+// ListDomainsForUser returns the sending domains a domain user reaches, with
+// application counts, ordered by name: the assigned ones, or every domain when
+// the user's All flag is set — which is how a domain added later is included.
+// The filter is in the query, so a caller cannot forget it.
 func (s *Store) ListDomainsForUser(userID int64) ([]Domain, error) {
 	rows, err := s.db.Query(`
 		SELECT d.id, d.name, d.dkim_selector, d.dmarc_rua, d.dmarc_rua_user_id, d.created_at,
 		       (SELECT COUNT(*) FROM applications a WHERE a.domain_id = d.id)
 		FROM domains d
-		INNER JOIN user_domains ud ON ud.domain_id = d.id
-		WHERE ud.user_id = ?
-		ORDER BY d.name`, userID)
+		WHERE EXISTS (SELECT 1 FROM users u WHERE u.id = ? AND u.all_domains = 1)
+		   OR EXISTS (SELECT 1 FROM user_domains ud WHERE ud.user_id = ? AND ud.domain_id = d.id)
+		ORDER BY d.name`, userID, userID)
 	if err != nil {
 		return nil, fmt.Errorf("list domains for user: %w", err)
 	}

internal/store/domains_dmarc_test.go

@@ -115,7 +115,7 @@ func TestDeletingTheFollowedUserLeavesNoReports(t *testing.T) {
 		t.Fatalf("CreateGlobalUser: %v", err)
 	}
 	d, _ := st.AddDomain("example.com", "sel")
-	id, err := st.CreateUser("second", "hash", RoleGlobal, nil)
+	id, err := st.CreateUser("second", "hash", RoleGlobal, Reach{})
 	if err != nil {
 		t.Fatalf("CreateUser: %v", err)
 	}

internal/store/inbound.go

@@ -113,6 +113,35 @@ func (s *Store) ListInboundDomains() ([]InboundDomain, error) {
 	return out, rows.Err()
 }
 
+// ListInboundDomainsForUser returns the inbound domains a domain user reaches,
+// ordered by name: the assigned ones, or every inbound domain when the user's
+// All flag is set. Like ListDomainsForUser, the filter is in the query.
+func (s *Store) ListInboundDomainsForUser(userID int64) ([]InboundDomain, error) {
+	rows, err := s.db.Query(`
+		SELECT d.id, d.name, d.recipient_mode, d.created_at,
+		       t.host, t.port, t.tls_mode,
+		       (SELECT COUNT(*) FROM inbound_recipients r WHERE r.inbound_domain_id = d.id)
+		FROM inbound_domains d
+		INNER JOIN inbound_transports t ON t.inbound_domain_id = d.id
+		WHERE EXISTS (SELECT 1 FROM users u WHERE u.id = ? AND u.all_inbound_domains = 1)
+		   OR EXISTS (SELECT 1 FROM user_inbound_domains ud WHERE ud.user_id = ? AND ud.inbound_domain_id = d.id)
+		ORDER BY d.name`, userID, userID)
+	if err != nil {
+		return nil, fmt.Errorf("list inbound domains for user: %w", err)
+	}
+	defer rows.Close()
+
+	var out []InboundDomain
+	for rows.Next() {
+		d, err := scanInboundDomain(rows)
+		if err != nil {
+			return nil, err
+		}
+		out = append(out, d)
+	}
+	return out, rows.Err()
+}
+
 // GetInboundDomain returns one inbound domain with its recipient list, or
 // ErrInboundDomainNotFound.
 func (s *Store) GetInboundDomain(id int64) (InboundDomain, error) {

internal/store/users.go

@@ -196,10 +196,39 @@ func (s *Store) ListUsers() ([]User, error) {
 	return users, rows.Err()
 }
 
-// UserRow is a user plus assigned domain names for the management list.
+// Reach is what a domain user is assigned: outbound and inbound domains are
+// granted separately, and the same name on both lists is two assignments. All
+// means every domain of that direction, including the ones added later; the
+// id list beside it is then ignored. Reach widens a list, never the role:
+// adding and deleting domains, the queues and Server stay with the global role.
+type Reach struct {
+	AllDomains       bool
+	DomainIDs        []int64
+	AllInbound       bool
+	InboundDomainIDs []int64
+}
+
+// Empty reports whether the reach assigns nothing at all. A domain user must
+// have something on at least one of the two lists.
+func (r Reach) Empty() bool {
+	return !r.AllDomains && len(r.DomainIDs) == 0 && !r.AllInbound && len(r.InboundDomainIDs) == 0
+}
+
+// Reach returns what the user is assigned.
+func (u User) Reach() Reach {
+	return Reach{AllDomains: u.AllDomains, DomainIDs: u.DomainIDs, AllInbound: u.AllInboundDomains, InboundDomainIDs: u.InboundDomainIDs}
+}
+
+// ErrEmptyReach is returned when a domain user would be left with nothing
+// assigned on either list.
+var ErrEmptyReach = errors.New("a domain user needs at least one outbound or inbound domain")
+
+// UserRow is a user plus the names of the assigned domains for the management
+// list. The names are empty where the user's All flag covers the direction.
 type UserRow struct {
-	User        User
-	DomainNames []string
+	User               User
+	DomainNames        []string
+	InboundDomainNames []string
 }
 
 // ListUserRows returns users with assigned domain names for the management UI.
@@ -214,11 +243,16 @@ func (s *Store) ListUserRows() ([]UserRow, error) {
 		if u.Role == RoleGlobal {
 			continue
 		}
-		names, err := s.listUserDomainNames(u.ID)
-		if err != nil {
-			return nil, err
+		if !u.AllDomains {
+			if rows[i].DomainNames, err = s.listUserDomainNames(u.ID); err != nil {
+				return nil, err
+			}
+		}
+		if !u.AllInboundDomains {
+			if rows[i].InboundDomainNames, err = s.listUserInboundDomainNames(u.ID); err != nil {
+				return nil, err
+			}
 		}
-		rows[i].DomainNames = names
 	}
 	return rows, nil
 }
@@ -232,10 +266,12 @@ func (s *Store) CountGlobalUsers() (int, error) {
 	return n, nil
 }
 
-// CreateUser inserts a panel user and optional domain assignments.
-func (s *Store) CreateUser(username, passwordHash string, role Role, domainIDs []int64) (int64, error) {
-	if role == RoleDomain && len(domainIDs) == 0 {
-		return 0, fmt.Errorf("create user: the domain role requires domains")
+// CreateUser inserts a panel user. A domain user is created with its reach in
+// the same call and must be given one (ErrEmptyReach); for a global user the
+// reach is ignored.
+func (s *Store) CreateUser(username, passwordHash string, role Role, reach Reach) (int64, error) {
+	if role == RoleDomain && reach.Empty() {
+		return 0, ErrEmptyReach
 	}
 	now := time.Now().UTC().Format(time.RFC3339)
 	res, err := s.db.Exec(
@@ -253,7 +289,7 @@ func (s *Store) CreateUser(username, passwordHash string, role Role, domainIDs [
 		return 0, fmt.Errorf("create user id: %w", err)
 	}
 	if role == RoleDomain {
-		if err := s.setUserDomains(id, domainIDs); err != nil {
+		if err := s.setUserReach(id, reach); err != nil {
 			return 0, err
 		}
 	}
@@ -339,28 +375,27 @@ func (s *Store) SetUserRole(userID int64, role Role) error {
 	return nil
 }
 
-// ClearUserDomains removes all domain assignments for a user.
-func (s *Store) ClearUserDomains(userID int64) error {
-	_, err := s.db.Exec("DELETE FROM user_domains WHERE user_id = ?", userID)
-	if err != nil {
-		return fmt.Errorf("clear user domains: %w", err)
-	}
-	return nil
+// ClearUserReach removes everything a user is assigned — both lists and both
+// All flags. A user promoted to the global role keeps none of it, so a later
+// demotion does not quietly bring an old assignment back.
+func (s *Store) ClearUserReach(userID int64) error {
+	return s.setUserReach(userID, Reach{})
 }
 
-// SetUserDomains replaces the outbound domain assignments of a domain user.
-func (s *Store) SetUserDomains(userID int64, domainIDs []int64) error {
+// SetUserReach replaces what a domain user is assigned, both directions at
+// once. ErrEmptyReach if nothing would be left.
+func (s *Store) SetUserReach(userID int64, reach Reach) error {
 	u, err := s.GetUser(userID)
 	if err != nil {
 		return err
 	}
 	if u.Role != RoleDomain {
-		return fmt.Errorf("set user domains: user does not have the domain role")
+		return fmt.Errorf("set user reach: user does not have the domain role")
 	}
-	if len(domainIDs) == 0 {
-		return fmt.Errorf("set user domains: at least one domain required")
+	if reach.Empty() {
+		return ErrEmptyReach
 	}
-	return s.setUserDomains(userID, domainIDs)
+	return s.setUserReach(userID, reach)
 }
 
 // DeleteUser removes a panel user. ErrLastGlobal when deleting the only global user.
@@ -427,6 +462,26 @@ func (s *Store) listUserDomainIDs(userID int64) ([]int64, error) {
 	return ids, rows.Err()
 }
 
+func (s *Store) listUserInboundDomainNames(userID int64) ([]string, error) {
+	rows, err := s.db.Query(
+		"SELECT d.name FROM user_inbound_domains ud JOIN inbound_domains d ON d.id = ud.inbound_domain_id WHERE ud.user_id = ? ORDER BY d.name",
+		userID,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("list user inbound domain names: %w", err)
+	}
+	defer rows.Close()
+	var names []string
+	for rows.Next() {
+		var name string
+		if err := rows.Scan(&name); err != nil {
+			return nil, fmt.Errorf("list user inbound domain names scan: %w", err)
+		}
+		names = append(names, name)
+	}
+	return names, rows.Err()
+}
+
 func (s *Store) listUserDomainNames(userID int64) ([]string, error) {
 	rows, err := s.db.Query(
 		"SELECT d.name FROM user_domains ud JOIN domains d ON d.id = ud.domain_id WHERE ud.user_id = ? ORDER BY d.name",
@@ -447,20 +502,40 @@ func (s *Store) listUserDomainNames(userID int64) ([]string, error) {
 	return names, rows.Err()
 }
 
-func (s *Store) setUserDomains(userID int64, domainIDs []int64) error {
+// setUserReach writes the flags and both assignment tables in one transaction.
+// With an All flag set the rows of that direction are dropped rather than
+// stored: the flag already covers them, and stale rows would come back to life
+// the day the flag is cleared.
+func (s *Store) setUserReach(userID int64, reach Reach) error {
 	tx, err := s.db.Begin()
 	if err != nil {
-		return fmt.Errorf("set user domains begin: %w", err)
+		return fmt.Errorf("set user reach begin: %w", err)
+	}
+	defer tx.Rollback()
+	if _, err := tx.Exec("UPDATE users SET all_domains = ?, all_inbound_domains = ? WHERE id = ?",
+		reach.AllDomains, reach.AllInbound, userID); err != nil {
+		return fmt.Errorf("set user reach flags: %w", err)
 	}
 	if _, err := tx.Exec("DELETE FROM user_domains WHERE user_id = ?", userID); err != nil {
-		tx.Rollback()
-		return fmt.Errorf("set user domains clear: %w", err)
+		return fmt.Errorf("set user reach clear: %w", err)
 	}
-	for _, did := range domainIDs {
-		if _, err := tx.Exec("INSERT INTO user_domains (user_id, domain_id) VALUES (?, ?)", userID, did); err != nil {
-			tx.Rollback()
-			return fmt.Errorf("set user domains insert: %w", err)
+	if _, err := tx.Exec("DELETE FROM user_inbound_domains WHERE user_id = ?", userID); err != nil {
+		return fmt.Errorf("set user reach clear inbound: %w", err)
+	}
+	if !reach.AllDomains {
+		for _, id := range reach.DomainIDs {
+			if _, err := tx.Exec("INSERT INTO user_domains (user_id, domain_id) VALUES (?, ?)", userID, id); err != nil {
+				return fmt.Errorf("set user reach insert: %w", err)
+			}
+		}
+	}
+	if !reach.AllInbound {
+		for _, id := range reach.InboundDomainIDs {
+			if _, err := tx.Exec("INSERT INTO user_inbound_domains (user_id, inbound_domain_id) VALUES (?, ?)", userID, id); err != nil {
+				return fmt.Errorf("set user reach insert inbound: %w", err)
+			}
 		}
 	}
 	return tx.Commit()
+
 }

internal/store/users_test.go

@@ -74,7 +74,7 @@ func TestCreateDomainAdminUser(t *testing.T) {
 	if err != nil {
 		t.Fatalf("AddDomain: %v", err)
 	}
-	id, err := st.CreateUser("domainop", "hash2", RoleDomain, []int64{d.ID})
+	id, err := st.CreateUser("domainop", "hash2", RoleDomain, Reach{DomainIDs: []int64{d.ID}})
 	if err != nil {
 		t.Fatalf("CreateUser: %v", err)
 	}
@@ -100,3 +100,98 @@ func TestDeleteLastGlobalUser(t *testing.T) {
 		t.Fatalf("DeleteUser = %v, want ErrLastGlobal", err)
 	}
 }
+
+// A domain user's reach covers two directions that are granted separately,
+// each with an All flag; the store writes and reads all four parts together.
+func TestUserReach(t *testing.T) {
+	st := openTestStore(t)
+	if err := st.CreateGlobalUser("admin", "hash"); err != nil {
+		t.Fatalf("CreateGlobalUser: %v", err)
+	}
+	out1, _ := st.AddDomain("one.example.com", "s1")
+	out2, _ := st.AddDomain("two.example.com", "s1")
+	in1, _ := st.AddInboundDomain("in-one.example.com")
+	in2, _ := st.AddInboundDomain("in-two.example.com")
+
+	if _, err := st.CreateUser("nothing", "h", RoleDomain, Reach{}); !errors.Is(err, ErrEmptyReach) {
+		t.Fatalf("a domain user with nothing assigned = %v, want ErrEmptyReach", err)
+	}
+	if exists, _ := st.GetUserByUsername("nothing"); exists.ID != 0 {
+		t.Fatal("the refused user was created")
+	}
+
+	// Inbound alone is enough: the role needs something on either list.
+	id, err := st.CreateUser("ops", "h", RoleDomain, Reach{InboundDomainIDs: []int64{in1.ID}})
+	if err != nil {
+		t.Fatalf("CreateUser: %v", err)
+	}
+	u, _ := st.GetUser(id)
+	if len(u.DomainIDs) != 0 || len(u.InboundDomainIDs) != 1 || u.InboundDomainIDs[0] != in1.ID || u.AllDomains || u.AllInboundDomains {
+		t.Fatalf("reach = %+v", u.Reach())
+	}
+	if got, _ := st.ListDomainsForUser(id); len(got) != 0 {
+		t.Errorf("an inbound assignment gave %d sending domains", len(got))
+	}
+	if got, _ := st.ListInboundDomainsForUser(id); len(got) != 1 || got[0].ID != in1.ID {
+		t.Errorf("inbound domains for the user = %+v", got)
+	}
+
+	// All replaces the rows of its direction and leaves the other alone.
+	if err := st.SetUserReach(id, Reach{AllDomains: true, DomainIDs: []int64{out1.ID}, InboundDomainIDs: []int64{in1.ID, in2.ID}}); err != nil {
+		t.Fatalf("SetUserReach: %v", err)
+	}
+	u, _ = st.GetUser(id)
+	if !u.AllDomains || len(u.DomainIDs) != 0 || len(u.InboundDomainIDs) != 2 {
+		t.Fatalf("reach after All = %+v; rows under All must not be stored", u.Reach())
+	}
+	// ...and All includes a domain added afterwards.
+	out3, _ := st.AddDomain("three.example.com", "s1")
+	got, err := st.ListDomainsForUser(id)
+	if err != nil || len(got) != 3 {
+		t.Fatalf("All lists %d sending domains (%v), want 3 including the one added later", len(got), err)
+	}
+	_ = out2
+	_ = out3
+
+	// Clearing All does not bring an old row back.
+	if err := st.SetUserReach(id, Reach{DomainIDs: []int64{out2.ID}, AllInbound: true}); err != nil {
+		t.Fatalf("SetUserReach: %v", err)
+	}
+	u, _ = st.GetUser(id)
+	if u.AllDomains || len(u.DomainIDs) != 1 || u.DomainIDs[0] != out2.ID || !u.AllInboundDomains || len(u.InboundDomainIDs) != 0 {
+		t.Fatalf("reach = %+v", u.Reach())
+	}
+	if got, _ := st.ListDomainsForUser(id); len(got) != 1 || got[0].ID != out2.ID {
+		t.Errorf("sending domains for the user = %+v", got)
+	}
+	if got, _ := st.ListInboundDomainsForUser(id); len(got) != 2 {
+		t.Errorf("All inbound lists %d domains, want 2", len(got))
+	}
+
+	rows, err := st.ListUserRows()
+	if err != nil {
+		t.Fatalf("ListUserRows: %v", err)
+	}
+	for _, r := range rows {
+		if r.User.ID != id {
+			continue
+		}
+		if len(r.DomainNames) != 1 || r.DomainNames[0] != "two.example.com" || len(r.InboundDomainNames) != 0 || !r.User.AllInboundDomains {
+			t.Errorf("list row = %+v", r)
+		}
+	}
+
+	if err := st.SetUserReach(id, Reach{}); !errors.Is(err, ErrEmptyReach) {
+		t.Errorf("emptying a domain user's reach = %v, want ErrEmptyReach", err)
+	}
+	admin, _ := st.GetUserByUsername("admin")
+	if err := st.SetUserReach(admin.ID, Reach{AllDomains: true}); err == nil {
+		t.Error("a reach was set on a global user")
+	}
+	if err := st.ClearUserReach(id); err != nil {
+		t.Fatalf("ClearUserReach: %v", err)
+	}
+	if u, _ = st.GetUser(id); !u.Reach().Empty() {
+		t.Errorf("reach after clearing = %+v", u.Reach())
+	}
+}