panel-redesign: inbound is delegated per user, separately from outbound

Stage 1, step 2 (plan § Who sees what).

Store
  - Reach{AllDomains, DomainIDs, AllInbound, InboundDomainIDs} is what a
    domain user is assigned. CreateUser takes it; SetUserReach / ClearUserReach
    replace SetUserDomains / ClearUserDomains and write both directions in one
    transaction. A domain user with nothing on either list is refused
    (ErrEmptyReach). With All set the rows of that direction are not stored,
    so clearing All later brings nothing stale back.
  - ListDomainsForUser honours all_domains; ListInboundDomainsForUser is its
    inbound twin. Both filter in the query.

Authorization
  - auth.Principal carries the whole reach: CanAccessDomain (now also true
    with All), CanAccessInboundDomain, HasOutbound, HasInbound. An id or a
    name on one list opens nothing on the other.
  - Inbound handlers in three strengths: requireInbound (the list, filtered),
    requireInboundDomain (one domain: page, DNS re-check, upstream,
    recipients), requireInboundGlobal (add, delete confirm, delete). All
    answer the same 404.
  - domainIDSet and the DMARC report pages go through the principal instead
    of looking at p.Domains themselves.

Panel (old templates, until stage 2)
  - User form: two lists with All; inbound is offered only where the feature
    is on, and saving the form with it off keeps the user's inbound reach.
    Promotion to global drops the reach.
  - Menu: a group with nothing assigned is absent; / sends an inbound-only
    administrator to Inbound. The inbound pages hide add / delete from a
    domain administrator.

Tests: every route of one inbound domain against five kinds of refused
request (another tenant's id, a missing id, outbound-only reach, an outbound
domain with the same id, one with the same name, no principal) with the 404
bodies compared; add/delete as every non-global user; the filtered list
including a domain added later; thirteen outbound routes against another
tenant's domain and application id; the user form; the reach in the store;
the principal matrix; the menu; the home redirect. Removing the access check
or the query filter makes the tests fail (checked by hand).

go test ./...  green except the two Windows-only failures in internal/domain
and internal/logtail that predate this work.

Roadmap 12/27.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/auth/principal.go

@@ -27,7 +27,12 @@ type Principal struct {
 	ID       int64
 	Username string
 	Role     Role
-	Domains  []int64 // assigned domain IDs; empty for global (all domains)
+	// What a domain user reaches (store.Reach). All four are unused for the
+	// global role, which reaches everything.
+	Domains        []int64 // assigned outbound domain ids
+	AllDomains     bool    // every outbound domain, including those added later
+	InboundDomains []int64 // assigned inbound domain ids
+	AllInbound     bool    // every inbound domain, including those added later
 }
 
 // IsGlobal reports whether the principal has full panel access.
@@ -35,9 +40,35 @@ func (p Principal) IsGlobal() bool {
 	return p.Role == RoleGlobal
 }
 
-// CanAccessDomain reports whether the principal may access a domain id.
+// HasOutbound reports whether the principal reaches any sending domain. A
+// group with nothing in it is absent from that user's menu.
+func (p Principal) HasOutbound() bool {
+	return p.IsGlobal() || p.AllDomains || len(p.Domains) > 0
+}
+
+// HasInbound reports whether the principal reaches any inbound domain.
+func (p Principal) HasInbound() bool {
+	return p.IsGlobal() || p.AllInbound || len(p.InboundDomains) > 0
+}
+
+// CanAccessInboundDomain reports whether the principal may access an inbound
+// domain id. Inbound is granted separately from outbound: a sending domain of
+// the same name gives no access here, and the other way round.
+func (p Principal) CanAccessInboundDomain(inboundDomainID int64) bool {
+	if p.IsGlobal() || p.AllInbound {
+		return true
+	}
+	for _, id := range p.InboundDomains {
+		if id == inboundDomainID {
+			return true
+		}
+	}
+	return false
+}
+
+// CanAccessDomain reports whether the principal may access a sending domain id.
 func (p Principal) CanAccessDomain(domainID int64) bool {
-	if p.IsGlobal() {
+	if p.IsGlobal() || p.AllDomains {
 		return true
 	}
 	for _, id := range p.Domains {
@@ -59,6 +90,10 @@ func principalFromUser(u store.User) Principal {
 		Username: u.Username,
 		Role:     u.Role,
 		Domains:  u.DomainIDs,
+
+		AllDomains:     u.AllDomains,
+		InboundDomains: u.InboundDomainIDs,
+		AllInbound:     u.AllInboundDomains,
 	}
 }
 

internal/web/auth/principal_test.go

@@ -0,0 +1,52 @@
+package auth
+
+import (
+	"testing"
+
+	"github.com/mixeme/selfpost/internal/store"
+)
+
+// Outbound and inbound are granted separately: an id on one list opens nothing
+// on the other, All opens a whole direction, and the global role opens both.
+func TestPrincipalReach(t *testing.T) {
+	for _, tc := range []struct {
+		name                    string
+		p                       Principal
+		out7, out8, in7, in8    bool
+		hasOutbound, hasInbound bool
+	}{
+		{"global", Principal{Role: RoleGlobal}, true, true, true, true, true, true},
+		{"outbound 7", Principal{Role: RoleDomain, Domains: []int64{7}}, true, false, false, false, true, false},
+		{"inbound 7", Principal{Role: RoleDomain, InboundDomains: []int64{7}}, false, false, true, false, false, true},
+		{"all outbound", Principal{Role: RoleDomain, AllDomains: true}, true, true, false, false, true, false},
+		{"all inbound, outbound 8", Principal{Role: RoleDomain, AllInbound: true, Domains: []int64{8}}, false, true, true, true, true, true},
+		{"nothing", Principal{Role: RoleDomain}, false, false, false, false, false, false},
+	} {
+		got := []bool{
+			tc.p.CanAccessDomain(7), tc.p.CanAccessDomain(8), tc.p.CanAccessInboundDomain(7), tc.p.CanAccessInboundDomain(8),
+			tc.p.HasOutbound(), tc.p.HasInbound(),
+		}
+		want := []bool{tc.out7, tc.out8, tc.in7, tc.in8, tc.hasOutbound, tc.hasInbound}
+		for i := range got {
+			if got[i] != want[i] {
+				t.Errorf("%s: [out 7, out 8, in 7, in 8, has out, has in] = %v, want %v", tc.name, got, want)
+				break
+			}
+		}
+	}
+	if !(Principal{Role: RoleDomain, Domains: []int64{7}}).CanAccessApp(store.Application{DomainID: 7}) {
+		t.Error("an application follows its sending domain")
+	}
+}
+
+// The principal a request carries is the user's whole reach, flags included.
+func TestPrincipalFromUser(t *testing.T) {
+	p := principalFromUser(store.User{
+		ID: 3, Username: "ops", Role: store.RoleDomain,
+		DomainIDs: []int64{1}, AllDomains: true, InboundDomainIDs: []int64{2, 4}, AllInboundDomains: true,
+	})
+	if p.ID != 3 || p.Username != "ops" || p.Role != RoleDomain || !p.AllDomains || !p.AllInbound ||
+		len(p.Domains) != 1 || len(p.InboundDomains) != 2 {
+		t.Errorf("principal = %+v", p)
+	}
+}