panel-redesign: inbound is delegated per user, separately from outbound

Stage 1, step 2 (plan § Who sees what).

Store
  - Reach{AllDomains, DomainIDs, AllInbound, InboundDomainIDs} is what a
    domain user is assigned. CreateUser takes it; SetUserReach / ClearUserReach
    replace SetUserDomains / ClearUserDomains and write both directions in one
    transaction. A domain user with nothing on either list is refused
    (ErrEmptyReach). With All set the rows of that direction are not stored,
    so clearing All later brings nothing stale back.
  - ListDomainsForUser honours all_domains; ListInboundDomainsForUser is its
    inbound twin. Both filter in the query.

Authorization
  - auth.Principal carries the whole reach: CanAccessDomain (now also true
    with All), CanAccessInboundDomain, HasOutbound, HasInbound. An id or a
    name on one list opens nothing on the other.
  - Inbound handlers in three strengths: requireInbound (the list, filtered),
    requireInboundDomain (one domain: page, DNS re-check, upstream,
    recipients), requireInboundGlobal (add, delete confirm, delete). All
    answer the same 404.
  - domainIDSet and the DMARC report pages go through the principal instead
    of looking at p.Domains themselves.

Panel (old templates, until stage 2)
  - User form: two lists with All; inbound is offered only where the feature
    is on, and saving the form with it off keeps the user's inbound reach.
    Promotion to global drops the reach.
  - Menu: a group with nothing assigned is absent; / sends an inbound-only
    administrator to Inbound. The inbound pages hide add / delete from a
    domain administrator.

Tests: every route of one inbound domain against five kinds of refused
request (another tenant's id, a missing id, outbound-only reach, an outbound
domain with the same id, one with the same name, no principal) with the 404
bodies compared; add/delete as every non-global user; the filtered list
including a domain added later; thirteen outbound routes against another
tenant's domain and application id; the user form; the reach in the store;
the principal matrix; the menu; the home redirect. Removing the access check
or the query filter makes the tests fail (checked by hand).

go test ./...  green except the two Windows-only failures in internal/domain
and internal/logtail that predate this work.

Roadmap 12/27.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/view/templates/inbound.html

@@ -11,6 +11,9 @@ Off by default in Compose.</p>
 
 <div class="card">
   <h2>Forwarding</h2>
+  {{/* Adding and deleting a domain stay with the global role; a domain
+       administrator works with the inbound domains assigned to them. */}}
+  {{if .IsGlobal}}
   <form method="post" action="/inbound">
     <label for="name">Add inbound domain</label>
     <div class="input-row">
@@ -21,6 +24,7 @@ Off by default in Compose.</p>
     </div>
     {{if .Error}}<p class="error">{{.Error}}</p>{{end}}
   </form>
+  {{end}}
   {{if .Domains}}
   <table>
     <thead>
@@ -34,7 +38,7 @@ Off by default in Compose.</p>
         <td class="muted">{{.Upstream}}</td>
         <td>{{.RcptLabel}}</td>
         <td><span class="st st-{{if eq .TLSMode "encrypt"}}ok{{else}}unknown{{end}}">{{.TLSLabel}}</span></td>
-        <td class="actions"><a class="danger" href="/inbound/{{.ID}}/delete">Delete</a></td>
+        <td class="actions">{{if $.IsGlobal}}<a class="danger" href="/inbound/{{.ID}}/delete">Delete</a>{{end}}</td>
       </tr>
       {{end}}
     </tbody>

internal/web/view/templates/inbound_domain.html

@@ -112,7 +112,7 @@
     <h2>Danger zone</h2>
     <p class="muted">Stops accepting mail for this domain. Does not touch
     outbound sending domains.</p>
-    <p><a class="danger" href="/inbound/{{.Domain.ID}}/delete">Delete inbound domain</a></p>
+    {{if .IsGlobal}}<p><a class="danger" href="/inbound/{{.Domain.ID}}/delete">Delete inbound domain</a></p>{{end}}
   </div>
 </div>
 {{end}}

internal/web/view/templates/layout_legacy.html

@@ -70,20 +70,26 @@
        the column: the mark, the panel's pages, and the session last. The mark
        goes to /status, the page the panel opens on — named outright rather
        than as "/", which is only a redirect to it. */}}
-  <a class="brand" href="{{if .IsGlobal}}/status{{else}}/domains{{end}}"><img src="/static/logo-compact.svg" width="220" height="100" alt="SelfPost"></a>
+  <a class="brand" href="{{if .IsGlobal}}/status{{else if .HasOutbound}}/domains{{else}}/inbound{{end}}"><img src="/static/logo-compact.svg" width="220" height="100" alt="SelfPost"></a>
   <div class="links">
     {{if .IsGlobal}}
     {{if eq .Active "status"}}<span aria-current="page">{{template "icon-status"}}Status</span>{{else}}<a href="/status">{{template "icon-status"}}Status</a>{{end}}
     {{end}}
+    {{/* A group with nothing assigned is absent from that user's menu: the
+         sending pages need outbound reach, Inbound needs inbound reach. */}}
+    {{if or .IsGlobal .HasOutbound}}
     {{if eq .Active "domains"}}<span aria-current="page">{{template "icon-domains"}}Domains</span>{{else}}<a href="/domains">{{template "icon-domains"}}Domains</a>{{end}}
-    {{if and .IsGlobal .InboundEnabled}}
+    {{end}}
+    {{if and .InboundEnabled (or .IsGlobal .HasInbound)}}
     {{if eq .Active "inbound"}}<span aria-current="page">{{template "icon-inbound"}}Inbound</span>{{else}}<a href="/inbound">{{template "icon-inbound"}}Inbound</a>{{end}}
     {{end}}
-    {{if .DMARCEnabled}}
+    {{if and .DMARCEnabled (or .IsGlobal .HasOutbound)}}
     {{if eq .Active "dmarc"}}<span aria-current="page">{{template "icon-dmarc"}}DMARC</span>{{else}}<a href="/dmarc">{{template "icon-dmarc"}}DMARC</a>{{end}}
     {{end}}
     {{if eq .Active "help"}}<span aria-current="page">{{template "icon-help"}}Help</span>{{else}}<a href="/help">{{template "icon-help"}}Help</a>{{end}}
+    {{if or .IsGlobal .HasOutbound}}
     {{if eq .Active "deliveries"}}<span aria-current="page">{{template "icon-deliveries"}}Deliveries</span>{{else}}<a href="/deliveries">{{template "icon-deliveries"}}Deliveries</a>{{end}}
+    {{end}}
     {{if .IsGlobal}}
     {{if eq .Active "mail_queue"}}<span aria-current="page">{{template "icon-mail-queue"}}Mail queue</span>{{else}}<a href="/mail-queue">{{template "icon-mail-queue"}}Mail queue</a>{{end}}
     {{if eq .Active "system_log"}}<span aria-current="page">{{template "icon-system-log"}}System log</span>{{else}}<a href="/system-log">{{template "icon-system-log"}}System log</a>{{end}}

internal/web/view/templates/user_form.html

@@ -21,9 +21,17 @@
     </select>
     {{if .LastGlobalLocked}}<p class="muted">The only global administrator cannot be demoted.</p>{{end}}
 
-    <fieldset id="domain-pick" data-domain-pick>
-      <legend>Assigned domains</legend>
-      <p class="muted">Required for domain administrators.</p>
+    {{/* Outbound and inbound domains are assigned separately; a domain
+         administrator needs at least one on either list. "All" also covers
+         domains added later — with it ticked the rows below are ignored. */}}
+    <div id="domain-pick" data-domain-pick>
+    <fieldset>
+      <legend>Outbound domains</legend>
+      <p class="muted">A domain administrator needs at least one outbound or inbound domain.</p>
+      <label class="check">
+        <input type="checkbox" name="all_domains" value="1" {{if .FormAllDomains}}checked{{end}}>
+        All, including domains added later
+      </label>
       {{range .Domains}}
       <label class="check">
         <input type="checkbox" name="domain_ids" value="{{.ID}}" {{if index $.FormDomains .ID}}checked{{end}}>
@@ -31,6 +39,22 @@
       </label>
       {{end}}
     </fieldset>
+    {{if .InboundEnabled}}
+    <fieldset>
+      <legend>Inbound domains</legend>
+      <label class="check">
+        <input type="checkbox" name="all_inbound_domains" value="1" {{if .FormAllInbound}}checked{{end}}>
+        All, including domains added later
+      </label>
+      {{range .InboundDomains}}
+      <label class="check">
+        <input type="checkbox" name="inbound_domain_ids" value="{{.ID}}" {{if index $.FormInbound .ID}}checked{{end}}>
+        {{.Name}}
+      </label>
+      {{end}}
+    </fieldset>
+    {{end}}
+    </div>
 
     <button type="submit">{{if .IsEdit}}Save{{else}}Create{{end}}</button>
   </form>

internal/web/view/templates/users.html

@@ -8,14 +8,15 @@
   {{if .Users}}
   <table>
     <thead>
-      <tr><th>Username</th><th>Role</th><th>Domains</th><th></th></tr>
+      <tr><th>Username</th><th>Role</th><th>Outbound domains</th>{{if .InboundEnabled}}<th>Inbound domains</th>{{end}}<th></th></tr>
     </thead>
     <tbody>
       {{range .Users}}
       <tr>
         <td>{{.User.Username}}</td>
-        <td>{{if eq .User.Role "global"}}Global{{else}}Domain admin{{end}}</td>
-        <td class="muted">{{if eq .User.Role "global"}}All{{else}}{{range $i, $n := .DomainNames}}{{if $i}}, {{end}}{{$n}}{{end}}{{end}}</td>
+        <td>{{.User.Role}}</td>
+        <td class="muted">{{if or (eq .User.Role "global") .User.AllDomains}}All{{else}}{{range $i, $n := .DomainNames}}{{if $i}}, {{end}}{{$n}}{{end}}{{end}}</td>
+        {{if $.InboundEnabled}}<td class="muted">{{if or (eq .User.Role "global") .User.AllInboundDomains}}All{{else}}{{range $i, $n := .InboundDomainNames}}{{if $i}}, {{end}}{{$n}}{{end}}{{end}}</td>{{end}}
         <td class="actions"><a href="/users/{{.User.ID}}">Edit</a></td>
       </tr>
       {{end}}

internal/web/view/templates_test.go

@@ -687,3 +687,46 @@ func TestNavIncludesHelp(t *testing.T) {
 		t.Error("nav is missing Help link")
 	}
 }
+
+// A group with nothing assigned is absent from that user's menu: a domain
+// administrator who was given inbound domains only sees Inbound and none of the
+// sending pages, and the mark takes them to what they have.
+func TestLegacyNavFollowsTheUsersReach(t *testing.T) {
+	engine, err := New("test")
+	if err != nil {
+		t.Fatalf("New: %v", err)
+	}
+	nav := func(data map[string]any) string {
+		t.Helper()
+		data["User"], data["Active"] = "ops", ""
+		data["InboundEnabled"], data["DMARCEnabled"] = true, true
+		var buf bytes.Buffer
+		if err := engine.Page("help").ExecuteTemplate(&buf, "nav", data); err != nil {
+			t.Fatalf("execute nav: %v", err)
+		}
+		return buf.String()
+	}
+	has := func(out, href string) bool { return strings.Contains(out, `href="`+href+`"`) }
+
+	out := nav(map[string]any{"HasInbound": true})
+	if !has(out, "/inbound") {
+		t.Errorf("an inbound-only administrator has no Inbound entry:\n%s", out)
+	}
+	for _, gone := range []string{"/domains", "/deliveries", "/dmarc", "/status", "/users", "/mail-queue"} {
+		if has(out, gone) {
+			t.Errorf("an inbound-only administrator is offered %s", gone)
+		}
+	}
+
+	out = nav(map[string]any{"HasOutbound": true})
+	if has(out, "/inbound") || !has(out, "/domains") || !has(out, "/deliveries") || !has(out, "/dmarc") {
+		t.Errorf("an outbound-only administrator's menu is wrong:\n%s", out)
+	}
+
+	out = nav(map[string]any{"IsGlobal": true})
+	for _, want := range []string{"/status", "/domains", "/inbound", "/dmarc", "/deliveries", "/users"} {
+		if !has(out, want) {
+			t.Errorf("the global role lost %s", want)
+		}
+	}
+}