panel-redesign: inbound is delegated per user, separately from outbound

Stage 1, step 2 (plan § Who sees what).

Store
  - Reach{AllDomains, DomainIDs, AllInbound, InboundDomainIDs} is what a
    domain user is assigned. CreateUser takes it; SetUserReach / ClearUserReach
    replace SetUserDomains / ClearUserDomains and write both directions in one
    transaction. A domain user with nothing on either list is refused
    (ErrEmptyReach). With All set the rows of that direction are not stored,
    so clearing All later brings nothing stale back.
  - ListDomainsForUser honours all_domains; ListInboundDomainsForUser is its
    inbound twin. Both filter in the query.

Authorization
  - auth.Principal carries the whole reach: CanAccessDomain (now also true
    with All), CanAccessInboundDomain, HasOutbound, HasInbound. An id or a
    name on one list opens nothing on the other.
  - Inbound handlers in three strengths: requireInbound (the list, filtered),
    requireInboundDomain (one domain: page, DNS re-check, upstream,
    recipients), requireInboundGlobal (add, delete confirm, delete). All
    answer the same 404.
  - domainIDSet and the DMARC report pages go through the principal instead
    of looking at p.Domains themselves.

Panel (old templates, until stage 2)
  - User form: two lists with All; inbound is offered only where the feature
    is on, and saving the form with it off keeps the user's inbound reach.
    Promotion to global drops the reach.
  - Menu: a group with nothing assigned is absent; / sends an inbound-only
    administrator to Inbound. The inbound pages hide add / delete from a
    domain administrator.

Tests: every route of one inbound domain against five kinds of refused
request (another tenant's id, a missing id, outbound-only reach, an outbound
domain with the same id, one with the same name, no principal) with the 404
bodies compared; add/delete as every non-global user; the filtered list
including a domain added later; thirteen outbound routes against another
tenant's domain and application id; the user form; the reach in the store;
the principal matrix; the menu; the home redirect. Removing the access check
or the query filter makes the tests fail (checked by hand).

go test ./...  green except the two Windows-only failures in internal/domain
and internal/logtail that predate this work.

Roadmap 12/27.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/store/users_test.go

@@ -74,7 +74,7 @@ func TestCreateDomainAdminUser(t *testing.T) {
 	if err != nil {
 		t.Fatalf("AddDomain: %v", err)
 	}
-	id, err := st.CreateUser("domainop", "hash2", RoleDomain, []int64{d.ID})
+	id, err := st.CreateUser("domainop", "hash2", RoleDomain, Reach{DomainIDs: []int64{d.ID}})
 	if err != nil {
 		t.Fatalf("CreateUser: %v", err)
 	}
@@ -100,3 +100,98 @@ func TestDeleteLastGlobalUser(t *testing.T) {
 		t.Fatalf("DeleteUser = %v, want ErrLastGlobal", err)
 	}
 }
+
+// A domain user's reach covers two directions that are granted separately,
+// each with an All flag; the store writes and reads all four parts together.
+func TestUserReach(t *testing.T) {
+	st := openTestStore(t)
+	if err := st.CreateGlobalUser("admin", "hash"); err != nil {
+		t.Fatalf("CreateGlobalUser: %v", err)
+	}
+	out1, _ := st.AddDomain("one.example.com", "s1")
+	out2, _ := st.AddDomain("two.example.com", "s1")
+	in1, _ := st.AddInboundDomain("in-one.example.com")
+	in2, _ := st.AddInboundDomain("in-two.example.com")
+
+	if _, err := st.CreateUser("nothing", "h", RoleDomain, Reach{}); !errors.Is(err, ErrEmptyReach) {
+		t.Fatalf("a domain user with nothing assigned = %v, want ErrEmptyReach", err)
+	}
+	if exists, _ := st.GetUserByUsername("nothing"); exists.ID != 0 {
+		t.Fatal("the refused user was created")
+	}
+
+	// Inbound alone is enough: the role needs something on either list.
+	id, err := st.CreateUser("ops", "h", RoleDomain, Reach{InboundDomainIDs: []int64{in1.ID}})
+	if err != nil {
+		t.Fatalf("CreateUser: %v", err)
+	}
+	u, _ := st.GetUser(id)
+	if len(u.DomainIDs) != 0 || len(u.InboundDomainIDs) != 1 || u.InboundDomainIDs[0] != in1.ID || u.AllDomains || u.AllInboundDomains {
+		t.Fatalf("reach = %+v", u.Reach())
+	}
+	if got, _ := st.ListDomainsForUser(id); len(got) != 0 {
+		t.Errorf("an inbound assignment gave %d sending domains", len(got))
+	}
+	if got, _ := st.ListInboundDomainsForUser(id); len(got) != 1 || got[0].ID != in1.ID {
+		t.Errorf("inbound domains for the user = %+v", got)
+	}
+
+	// All replaces the rows of its direction and leaves the other alone.
+	if err := st.SetUserReach(id, Reach{AllDomains: true, DomainIDs: []int64{out1.ID}, InboundDomainIDs: []int64{in1.ID, in2.ID}}); err != nil {
+		t.Fatalf("SetUserReach: %v", err)
+	}
+	u, _ = st.GetUser(id)
+	if !u.AllDomains || len(u.DomainIDs) != 0 || len(u.InboundDomainIDs) != 2 {
+		t.Fatalf("reach after All = %+v; rows under All must not be stored", u.Reach())
+	}
+	// ...and All includes a domain added afterwards.
+	out3, _ := st.AddDomain("three.example.com", "s1")
+	got, err := st.ListDomainsForUser(id)
+	if err != nil || len(got) != 3 {
+		t.Fatalf("All lists %d sending domains (%v), want 3 including the one added later", len(got), err)
+	}
+	_ = out2
+	_ = out3
+
+	// Clearing All does not bring an old row back.
+	if err := st.SetUserReach(id, Reach{DomainIDs: []int64{out2.ID}, AllInbound: true}); err != nil {
+		t.Fatalf("SetUserReach: %v", err)
+	}
+	u, _ = st.GetUser(id)
+	if u.AllDomains || len(u.DomainIDs) != 1 || u.DomainIDs[0] != out2.ID || !u.AllInboundDomains || len(u.InboundDomainIDs) != 0 {
+		t.Fatalf("reach = %+v", u.Reach())
+	}
+	if got, _ := st.ListDomainsForUser(id); len(got) != 1 || got[0].ID != out2.ID {
+		t.Errorf("sending domains for the user = %+v", got)
+	}
+	if got, _ := st.ListInboundDomainsForUser(id); len(got) != 2 {
+		t.Errorf("All inbound lists %d domains, want 2", len(got))
+	}
+
+	rows, err := st.ListUserRows()
+	if err != nil {
+		t.Fatalf("ListUserRows: %v", err)
+	}
+	for _, r := range rows {
+		if r.User.ID != id {
+			continue
+		}
+		if len(r.DomainNames) != 1 || r.DomainNames[0] != "two.example.com" || len(r.InboundDomainNames) != 0 || !r.User.AllInboundDomains {
+			t.Errorf("list row = %+v", r)
+		}
+	}
+
+	if err := st.SetUserReach(id, Reach{}); !errors.Is(err, ErrEmptyReach) {
+		t.Errorf("emptying a domain user's reach = %v, want ErrEmptyReach", err)
+	}
+	admin, _ := st.GetUserByUsername("admin")
+	if err := st.SetUserReach(admin.ID, Reach{AllDomains: true}); err == nil {
+		t.Error("a reach was set on a global user")
+	}
+	if err := st.ClearUserReach(id); err != nil {
+		t.Fatalf("ClearUserReach: %v", err)
+	}
+	if u, _ = st.GetUser(id); !u.Reach().Empty() {
+		t.Errorf("reach after clearing = %+v", u.Reach())
+	}
+}