backup-reauth: the account password before a backup or an export

Agreed with the owner on 2026-10-13, taken up on 2026-10-16 ("Да"); the
mockup is 1888dce. Both secret downloads - the full backup on Server ›
Backup and a domain's export on its settings - ask for "Your account
password": reauth (handlers_backup.go) checks the signed-in user's own
password with bcrypt, as a password change does, under the same limiter
(auth.AllowPasswordChange: ten in fifteen minutes per user, shared with the
Account form). A wrong or missing one is 401 on the same page with "Your
account password is incorrect.", logged; nothing is sent. The import and
the selfpost-backup CLI are not asked.

Also, the owner's phone screenshot of 2026-10-16 ("кнопка выбора файла не
такая, как в макете. Это косяк?"): the import's file field was a bare
<input type="file"> drawn by the browser ("Browse…"), where the mockup has
Bulma's .file - "Choose a file…" and the name chosen. The template now
follows the mockup; panel.js writes the name into .file-name on change and
at load (testdata/filename_test.js, run by TestPanelJS). No other file
field exists.

Tests: TestSecretDownloadsAskForTheAccountPassword (missing, wrong, right,
the limiter), the export refusals of the settings page with the password,
cmd/panel's restore tests and e2e's backups with it, e2e's refusal of a
backup without and with a wrong password. go vet + go test (26 packages)
and make e2e on the test server for this tree.

Docs: security.md § Backup and domain export, guide § Full backup and
restore, help (word for word with the mockup); CHANGELOG [Unreleased];
roadmap row done.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/handlers/handlers_backup.go

@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"strconv"
 	"strings"
 	"time"
 
@@ -16,6 +17,7 @@ import (
 	"github.com/mixeme/selfpost/internal/store"
 	"github.com/mixeme/selfpost/internal/web/validate"
 	"github.com/mixeme/selfpost/internal/web/view"
+	"golang.org/x/crypto/bcrypt"
 )
 
 // maxImportBytes caps a domain-import upload. A domain export is a small JSON
@@ -65,6 +67,10 @@ func (h *Handlers) HandleBackup(w http.ResponseWriter, r *http.Request) {
 	if _, ok := h.requireGlobal(w, r); !ok {
 		return
 	}
+	if status, msg := h.reauth(r, "full backup"); status != 0 {
+		h.renderBackupPageWith(w, r, status, "", msg)
+		return
+	}
 	password, pwErr := secretFilePassword(r)
 	if pwErr != "" {
 		h.renderBackupPageWith(w, r, http.StatusBadRequest, "", pwErr)
@@ -161,6 +167,10 @@ func (h *Handlers) HandleExportDomain(w http.ResponseWriter, r *http.Request) {
 	if !ok {
 		return
 	}
+	if status, msg := h.reauth(r, "export of domain "+strconv.FormatInt(d.ID, 10)); status != 0 {
+		h.renderDomainSettings(w, r, status, d, settingsView{Err: msg})
+		return
+	}
 	password, pwErr := secretFilePassword(r)
 	if pwErr != "" {
 		h.renderDomainSettings(w, r, http.StatusBadRequest, d, settingsView{Err: pwErr})
@@ -314,6 +324,38 @@ func (h *Handlers) HandleImportDomain(w http.ResponseWriter, r *http.Request) {
 // form. The confirmation field is checked here rather than in the browser
 // because a typo in an encryption password is unrecoverable: the archive would
 // be sealed with a secret the operator does not know.
+// reauth checks the account password a secret download asks for
+// (backup-reauth): the full backup holds the whole database - the panel's
+// password hashes, every application's SASL password, the DKIM keys - and a
+// domain's export its key and its applications' credentials, so a session
+// alone, stolen or left open, must not be enough to take them. The password
+// is the signed-in user's own, checked as a password change checks it and
+// under the same limiter (auth.AllowPasswordChange), so the form is no place
+// to guess one. It returns 0 when it holds, else the status and the message
+// for the form. what names the download in the log.
+func (h *Handlers) reauth(r *http.Request, what string) (int, string) {
+	p, ok := h.principal(r)
+	if !ok {
+		return http.StatusUnauthorized, "Sign in again."
+	}
+	if !h.auth.AllowPasswordChange(p.ID) {
+		return http.StatusTooManyRequests, "Too many attempts. Please wait and try again."
+	}
+	if err := r.ParseForm(); err != nil {
+		return http.StatusBadRequest, "Invalid form submission."
+	}
+	u, err := h.store.GetUser(p.ID)
+	if err != nil {
+		logf("panel: %s: get user %d: %v", what, p.ID, err)
+		return http.StatusInternalServerError, "Internal error. Please try again."
+	}
+	if err := bcrypt.CompareHashAndPassword([]byte(u.PasswordHash), []byte(r.PostFormValue("account_password"))); err != nil {
+		logf("panel: %s: user %d gave a wrong account password", what, p.ID)
+		return http.StatusUnauthorized, "Your account password is incorrect."
+	}
+	return 0, ""
+}
+
 func secretFilePassword(r *http.Request) (password, errMsg string) {
 	if err := r.ParseForm(); err != nil {
 		return "", "Invalid form submission."