release: 0.5.0: Pre-1.0 security review, domain-admin role, doc consolidation

A bounce could be recorded as a successful delivery. The log-tailer's Fixed: - A bounce could be recorded as a successful delivery. The log-tailer's - Log-tailer resumes where it stopped instead of jumping to end-of-file on - Level-2 rate limit no longer overshoots under concurrency: messages that Changed: - The project has a single public home: `github.com/mixeme/selfpost`. Codeberg - Code comments no longer cite the archived specification. References like - `docs/code-review.md` is gone. Its plan is finished — phases 0 (bar the - `docs/architecture.md` gained a *Code layers* section: a diagram of - Phase 1 doc/code hygiene (`docs/code-review.md`): removed ~30 stale … (1 more in CHANGELOG) Security: - Pre-release security review (plan § D, model Fable, 2026-08-06): full pass - `saslpasswd2` argv: the application login is now passed after a `--` Added: - Optional password encryption for the two secret-bearing downloads (plan - Domain import accepts an encrypted export: the envelope is detected by its - `selfpost-backup` writes encrypted archives and reads them back: - `TestParseDelivery` covers the exotic mail.log shapes the review asked for - docs: README *Encrypting a backup or export*; `docs/security.md` § … (14 more in CHANGELOG) Removed: - docs: `security.md` — accepted risk «restore old backup revives session rows» Changed: - docs: `implementation-plan.md` trimmed to the sole open v1.x gate — pre-release - docs: `architecture.md` — sessions (SQLite, idle renew, password change), - docs: `development.md` — expanded e2e stack and `release.yml` matrix workflow. - docs: `security.md` — accepted risk for send-log rows stuck at `queued` after - docs: `roadmap.md` — optional send-log / `mail.log` follow-ups under v1.x tail. … (10 more in CHANGELOG) Full detail: CHANGELOG.md (0.5.0).
2026-09-22 15:24:51 +03:00
parent 72b09d60a6
commit 5e5d157496
113 changed files with 4284 additions and 1140 deletions
@@ -0,0 +1,127 @@
+package web
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"testing"
+
+	"github.com/mixeme/selfpost/internal/secretfile"
+)
+
+// postForm builds the kind of request the backup and export forms submit.
+func postForm(values url.Values) *http.Request {
+	r := httptest.NewRequest(http.MethodPost, "/backup", strings.NewReader(values.Encode()))
+	r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	return r
+}
+
+// The encryption password is only ever typed once into a file nobody can
+// recover without it, so every way of getting it wrong has to be caught before
+// the archive is sealed — and leaving the box unticked has to keep producing
+// the plain archive earlier versions produced.
+func TestSecretFilePassword(t *testing.T) {
+	long := strings.Repeat("x", minSecretFilePasswordLen)
+	short := strings.Repeat("x", minSecretFilePasswordLen-1)
+
+	tests := []struct {
+		name     string
+		form     url.Values
+		wantPass string
+		wantErr  bool
+	}{
+		{
+			name:     "unticked box means no encryption",
+			form:     url.Values{"password": {long}, "password_confirm": {long}},
+			wantPass: "",
+		},
+		{
+			name:     "ticked with a matching password",
+			form:     url.Values{"encrypt": {"1"}, "password": {long}, "password_confirm": {long}},
+			wantPass: long,
+		},
+		{
+			name:    "mistyped confirmation",
+			form:    url.Values{"encrypt": {"1"}, "password": {long}, "password_confirm": {long + "!"}},
+			wantErr: true,
+		},
+		{
+			name:    "too short",
+			form:    url.Values{"encrypt": {"1"}, "password": {short}, "password_confirm": {short}},
+			wantErr: true,
+		},
+		{
+			name:    "ticked but empty",
+			form:    url.Values{"encrypt": {"1"}},
+			wantErr: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			pass, errMsg := secretFilePassword(postForm(tt.form))
+			if tt.wantErr {
+				if errMsg == "" {
+					t.Fatalf("password %q accepted, want a rejection", pass)
+				}
+				if pass != "" {
+					t.Errorf("a rejected form still yielded password %q", pass)
+				}
+				return
+			}
+			if errMsg != "" {
+				t.Fatalf("unexpected rejection: %s", errMsg)
+			}
+			if pass != tt.wantPass {
+				t.Errorf("password = %q, want %q", pass, tt.wantPass)
+			}
+		})
+	}
+}
+
+// The messages the import form shows must distinguish the operator's likely
+// mistakes; a wrong password and a tampered file stay deliberately merged.
+func TestDecryptErrorMessage(t *testing.T) {
+	tests := []struct {
+		err  error
+		want string
+	}{
+		{secretfile.ErrWrongPassword, "Wrong password"},
+		{fmt.Errorf("read: %w", secretfile.ErrCorrupt), "damaged"},
+		{secretfile.ErrNotEncrypted, "not a SelfPost export"},
+		{errors.New("something else"), "Could not decrypt"},
+	}
+	for _, tt := range tests {
+		if got := decryptErrorMessage(tt.err); !strings.Contains(got, tt.want) {
+			t.Errorf("decryptErrorMessage(%v) = %q, want it to mention %q", tt.err, got, tt.want)
+		}
+	}
+}
+
+// The encryption controls are shared markup pulled into two pages; a page that
+// forgets to include the partial (or the data it needs) loses the option
+// silently, since the plain download still works.
+func TestBackupPageOffersEncryption(t *testing.T) {
+	tmpl, err := loadTemplates()
+	if err != nil {
+		t.Fatalf("loadTemplates: %v", err)
+	}
+	s := &Server{tmpl: tmpl, cfg: Config{Version: "test"}}
+	rec := httptest.NewRecorder()
+	s.renderBackupPageWith(rec, httptest.NewRequest(http.MethodGet, "/backup", nil),
+		http.StatusOK, "", "The two passwords do not match.")
+
+	body := rec.Body.String()
+	for _, want := range []string{
+		`name="encrypt"`, `name="password"`, `name="password_confirm"`,
+		`name="import_password"`, "data-encrypt-toggle", "data-encrypt-fields",
+		fmt.Sprintf("at least %d characters", minSecretFilePasswordLen),
+		"The two passwords do not match.",
+	} {
+		if !strings.Contains(body, want) {
+			t.Errorf("backup page is missing %q", want)
+		}
+	}
+}