backup-reauth: the account password before a backup or an export

Agreed with the owner on 2026-10-13, taken up on 2026-10-16 ("Да"); the
mockup is 1888dce. Both secret downloads - the full backup on Server ›
Backup and a domain's export on its settings - ask for "Your account
password": reauth (handlers_backup.go) checks the signed-in user's own
password with bcrypt, as a password change does, under the same limiter
(auth.AllowPasswordChange: ten in fifteen minutes per user, shared with the
Account form). A wrong or missing one is 401 on the same page with "Your
account password is incorrect.", logged; nothing is sent. The import and
the selfpost-backup CLI are not asked.

Also, the owner's phone screenshot of 2026-10-16 ("кнопка выбора файла не
такая, как в макете. Это косяк?"): the import's file field was a bare
<input type="file"> drawn by the browser ("Browse…"), where the mockup has
Bulma's .file - "Choose a file…" and the name chosen. The template now
follows the mockup; panel.js writes the name into .file-name on change and
at load (testdata/filename_test.js, run by TestPanelJS). No other file
field exists.

Tests: TestSecretDownloadsAskForTheAccountPassword (missing, wrong, right,
the limiter), the export refusals of the settings page with the password,
cmd/panel's restore tests and e2e's backups with it, e2e's refusal of a
backup without and with a wrong password. go vet + go test (26 packages)
and make e2e on the test server for this tree.

Docs: security.md § Backup and domain export, guide § Full backup and
restore, help (word for word with the mockup); CHANGELOG [Unreleased];
roadmap row done.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/handlers/handlers_backup_test.go

@@ -133,3 +133,42 @@ func TestEmptyCertsMessage(t *testing.T) {
 		t.Errorf("message = %q", msg)
 	}
 }
+
+// A session is not enough for a secret download (backup-reauth): the full
+// backup and a domain's export ask for the signed-in user's own password.
+// Wrong or missing, nothing is sent and the page says so; right, the request
+// goes on to its own checks. Guesses share the password change's limiter.
+func TestSecretDownloadsAskForTheAccountPassword(t *testing.T) {
+	s := newAppStand(t)
+	exportPath := "/outbound/domains/" + idStr(s.d.ID) + "/settings/export"
+	for _, pw := range []string{"", "wrong-password-entirely"} {
+		rec := postFormAs(s.h.HandleExportDomain, globalPrincipal, exportPath, s.paths, url.Values{"account_password": {pw}})
+		if rec.Code != http.StatusUnauthorized || rec.Header().Get("Content-Disposition") != "" ||
+			!strings.Contains(rec.Body.String(), "Your account password is incorrect.") {
+			t.Fatalf("export with account password %q = %d, %q:\n%.600s", pw, rec.Code, rec.Header().Get("Content-Disposition"), rec.Body.String())
+		}
+		rec = postFormAs(s.h.HandleBackup, globalPrincipal, "/server/backup", nil, url.Values{"account_password": {pw}})
+		if rec.Code != http.StatusUnauthorized || rec.Header().Get("Content-Disposition") != "" ||
+			!strings.Contains(rec.Body.String(), "Your account password is incorrect.") ||
+			!strings.Contains(rec.Body.String(), `name="account_password" type="password" autocomplete="current-password" required`) {
+			t.Fatalf("backup with account password %q = %d:\n%.600s", pw, rec.Code, rec.Body.String())
+		}
+	}
+
+	// The right password lets the export through: a plain JSON download.
+	rec := postFormAs(s.h.HandleExportDomain, globalPrincipal, exportPath, s.paths, url.Values{"account_password": {"correct-password-here!"}})
+	if rec.Code != http.StatusOK || !strings.Contains(rec.Header().Get("Content-Disposition"), "selfpost-domain-example.org.json") {
+		t.Fatalf("export with the right password = %d, %q:\n%.600s", rec.Code, rec.Header().Get("Content-Disposition"), rec.Body.String())
+	}
+
+	// Five checks were made above, and the limiter allows ten in its window:
+	// after six more, a check is refused before the password is looked at,
+	// the right one included.
+	for i := 0; i < 6; i++ {
+		postFormAs(s.h.HandleBackup, globalPrincipal, "/server/backup", nil, url.Values{"account_password": {"guess"}})
+	}
+	rec = postFormAs(s.h.HandleExportDomain, globalPrincipal, exportPath, s.paths, url.Values{"account_password": {"correct-password-here!"}})
+	if rec.Code != http.StatusTooManyRequests || !strings.Contains(rec.Body.String(), "Too many attempts.") {
+		t.Fatalf("after ten checks = %d:\n%.600s", rec.Code, rec.Body.String())
+	}
+}