audit 6: documents, comments, dead code and staticcheck; the test gaps closed

The last stage of the 2026-10-12 audit; no cut.

Doc drift: architecture.md (the sender check in § OpenDKIM, the limit:
row's 48 hours, the inbound log and filter-list routes and who may open
them, migrations to 0011 and every table, KitPage as production data,
Reload configuration as a restore writes, the panel's roles counted),
schema-migrations.md (tables and columns since v2), guide.md (a delivery's
lines go at the next prune; INBOUND_JOURNAL_MILTER_SOCKET moved to
architecture.md's internal list), development.md (the env guard, the
deferral the e2e proves, its fixed sleeps), roadmap.md.

Comments say what the code does now; TestBaselineIsTheOnlyMigration is
TestChainStartsAtTheBaseline; the milter package doc names its three
milters.

Dead code gone: view.Facts, dmarc HostedSuggestion and
ValidateHostedAddress, app UpdateMode (each with the test that alone kept
it), the method checks the method-bound routes made dead;
Settings.WithResult calls resultFlash. staticcheck 2026.1 in test.yml on
both modules, clean: the e2e package builds without its tests now (a test
and two constants moved out of non-test files), three findings fixed.
The test moved, TestImageBuildPreservesLogrotateMode, had sat in a
non-test file and never run; run, it failed on the entrypoint (docker run
without a hostname) and now asks with --entrypoint stat.

The test gaps no step named, each closed: follow() with mail.log gone past
blindMin and made again; CheckRestore with a manifest that is not JSON;
the origin check with a port; every /server/ pattern in web.go through
server() and in the routes table (it found GET /server/health/fragment
missing from the table - guarded, not tested); L9 as the owner decided it
on 2026-10-12, the comment on senderSession.Headers and the test passing
an h that holds the earlier messages' From:.

Plan stage 6 ticked; roadmap audit row done, 81/81.

Tested on the test server: go vet + go test of 27 packages, make e2e (all
pass, 513 s) on this tree; staticcheck locally on both modules.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/app/service.go

@@ -127,24 +127,6 @@ func (s *Service) Secret(login string) (string, error) {
 	return s.sasl.Secret(login)
 }
 
-// UpdateMode switches an application's address mode / list and rebuilds the
-// sender map (product.md). The login and password are untouched. Addresses are
-// re-validated against the application's domain.
-func (s *Service) UpdateMode(id int64, mode string, rawAddresses []string) error {
-	a, err := s.store.GetApplication(id)
-	if err != nil {
-		return err
-	}
-	addresses, err := s.validateForDomain(a.DomainID, a.Login, mode, rawAddresses)
-	if err != nil {
-		return err
-	}
-	if err := s.store.UpdateApplicationMode(id, mode, addresses); err != nil {
-		return err
-	}
-	return s.Resync()
-}
-
 // RegeneratePassword issues a fresh password for an existing application (spec
 // 7.2.9). The old password is invalidated by overwriting the SASL account; the
 // address mode and bindings are unchanged, so no map rebuild is needed. The new

internal/app/service_test.go

@@ -247,26 +247,6 @@ func TestServiceDeleteKeepsRowWhenSASLFails(t *testing.T) {
 	}
 }
 
-func TestServiceUpdateMode(t *testing.T) {
-	svc, st, _, maps := newServiceHarness(t)
-	d := addDomain(t, st, "example.com")
-	a, _, err := svc.Create(d.ID, "app1", store.AddressModeWildcard, nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if err := svc.UpdateMode(a.ID, store.AddressModeList, []string{"alerts@example.com"}); err != nil {
-		t.Fatalf("UpdateMode: %v", err)
-	}
-	if len(maps.last) != 1 || maps.last[0].Address != "alerts@example.com" {
-		t.Errorf("map after mode switch = %+v", maps.last)
-	}
-	got, _ := st.GetApplication(a.ID)
-	if got.AddressMode != store.AddressModeList || len(got.Addresses) != 1 {
-		t.Errorf("stored app after switch = %+v", got)
-	}
-}
-
 func TestServiceRegeneratePassword(t *testing.T) {
 	svc, st, rec, _ := newServiceHarness(t)
 	d := addDomain(t, st, "example.com")

internal/backup/backup_test.go

@@ -409,6 +409,28 @@ func TestCheckRestoreWrongFormatRejected(t *testing.T) {
 	}
 }
 
+// A manifest that is not JSON - cut short, or not one at all - stops the
+// start and stays for the operator to look at.
+func TestCheckRestoreRefusesAManifestThatIsNotJSON(t *testing.T) {
+	for _, body := range []string{`{"format": "selfpost-full", "version":`, "not json", ""} {
+		dir := t.TempDir()
+		path := filepath.Join(dir, ManifestName)
+		if err := os.WriteFile(path, []byte(body), 0o600); err != nil {
+			t.Fatal(err)
+		}
+		restored, err := CheckRestore(path, "1.0.0")
+		if err == nil || !strings.Contains(err.Error(), "not valid JSON") {
+			t.Errorf("manifest %q: err = %v, want not valid JSON", body, err)
+		}
+		if restored {
+			t.Errorf("manifest %q reported a restore", body)
+		}
+		if _, statErr := os.Stat(path); statErr != nil {
+			t.Errorf("manifest %q must be kept: %v", body, statErr)
+		}
+	}
+}
+
 // No archive holds the Postfix queue; the rest is there, the private key
 // included, and Check agrees that it can be made.
 func TestCreateLeavesTheQueueOut(t *testing.T) {

internal/dmarc/refusals_test.go

@@ -91,10 +91,7 @@ func TestServiceResyncAndHostedAddress(t *testing.T) {
 	d, _ := st.AddDomain("example.org", "sel")
 	maps := &recordingMaps{}
 	s := NewService(st, maps, " Mail.Example.COM ", true)
-	if got := s.HostedSuggestion("example.org"); got != "dmarc-reports+example.org@mail.example.com" {
-		t.Errorf("suggestion = %q", got)
-	}
-	if err := st.SetDomainDMARCAddress(d.ID, s.HostedSuggestion("example.org")); err != nil {
+	if err := st.SetDomainDMARCAddress(d.ID, HostedReportAddress("mail.example.com", "example.org")); err != nil {
 		t.Fatal(err)
 	}
 	if err := s.Resync(); err != nil {
@@ -112,11 +109,4 @@ func TestServiceResyncAndHostedAddress(t *testing.T) {
 	if last := maps.got[len(maps.got)-1]; len(last.Recipients) != 0 || len(last.Domains) != 0 {
 		t.Errorf("switched off, the maps hold %+v", last)
 	}
-
-	if err := s.ValidateHostedAddress("dmarc-reports+example.org@mail.example.com"); err != nil {
-		t.Errorf("the hosted address refused: %v", err)
-	}
-	if err := s.ValidateHostedAddress("reports@elsewhere.example"); err == nil {
-		t.Error("an address on another host passed as hosted")
-	}
 }

internal/dmarc/service.go

@@ -3,7 +3,6 @@
 package dmarc
 
 import (
-	"fmt"
 	"sort"
 	"strings"
 
@@ -94,16 +93,3 @@ func recipientDomains(addrs []string) []string {
 	sort.Strings(out)
 	return out
 }
-
-// HostedSuggestion returns the address the panel should suggest for a domain.
-func (s *Service) HostedSuggestion(domain string) string {
-	return HostedReportAddress(s.hostname, domain)
-}
-
-// ValidateHostedAddress ensures addr is on this hostname before saving.
-func (s *Service) ValidateHostedAddress(addr string) error {
-	if !IsHostedOnHostname(addr, s.hostname) {
-		return fmt.Errorf("hosted report address must be on %s", s.hostname)
-	}
-	return nil
-}

internal/health/machine.go

@@ -225,7 +225,7 @@ func (m *MachineSampler) Sample() Machine {
 
 // cpuUsage grades the processor over the window. Detail carries only the
 // core and thread counts — load average and busy prose stay out of the Status
-// card (see roadmap panel-docs for operator-facing explanation later).
+// card (the readings are described in docs/guide.md, "Overview and Health").
 func cpuUsage(prev, cur cpuTimes, cores, threads int, load [3]float64, fresh bool, err error) CPU {
 	c := CPU{Cores: cores, Threads: threads}
 	if !isZeroLoad(load) {

internal/logtail/logtail.go

@@ -612,11 +612,12 @@ func SplitTimestamp(line string) (stamp, rest string) {
 // follow tails path line by line, calling handle for each complete line, until
 // ctx is cancelled. Where it starts is tr's decision (a persisted offset, the
 // start of a file that changed while the panel was down, or end-of-file on a
-// first ever run); it reopens the file when it is rotated (inode change from
-// logrotate's create, or truncation from copytruncate) so nothing is missed.
+// first ever run); it reopens the file when it is rotated, so nothing is missed.
+// The inode changes under logrotate's create, which build/logrotate-mail.conf
+// uses; a file shorter than the read position is taken as truncation.
 // logrotate 3.21.0, logrotate.c, rotateSingleLog(): without copytruncate the
-// file is rename()d and, with create (build/logrotate-mail.conf), a new one
-// made by createOutputFile(); with copytruncate it is copied and truncated.
+// file is rename()d and, with create, a new one made by createOutputFile();
+// with copytruncate it is copied and truncated, which that config does not use.
 //
 // caughtUp is closed after the first read that reaches end-of-file, which is
 // the point where every line the panel missed while it was down has been

internal/logtail/logtail_test.go

@@ -258,6 +258,8 @@ type captureStore struct {
 	missed     int64
 	stuckCount int64
 	stuck      []int64
+	// blind holds the stretches AddTailerBlind was given.
+	blind []time.Duration
 
 	// lines are the log lines kept for messages' pages; pruned is the cutoff of
 	// each PruneSendLogLines call.
@@ -357,7 +359,12 @@ func (c *captureStore) AddReconcileMissed(_ time.Time, n int64) error {
 	c.missed += n
 	return nil
 }
-func (c *captureStore) AddTailerBlind(time.Time, time.Duration) error { return nil }
+func (c *captureStore) AddTailerBlind(_ time.Time, d time.Duration) error {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.blind = append(c.blind, d)
+	return nil
+}
 func (c *captureStore) AttachRefusalLine(string, string, string, time.Time, string) (bool, error) {
 	return true, nil
 }
@@ -456,6 +463,51 @@ func TestFollowTailsAndRotates(t *testing.T) {
 	}
 }
 
+// mail.log gone for longer than blindMin is a stretch the tailer could not
+// read, counted for Health; the file made again is read from its start. Like
+// TestFollowTailsAndRotates this runs on the server.
+func TestFollowCountsALogItCannotReadAndReadsItAgain(t *testing.T) {
+	old := pollInterval
+	pollInterval = 10 * time.Millisecond
+	t.Cleanup(func() { pollInterval = old })
+
+	dir := t.TempDir()
+	path := filepath.Join(dir, "mail.log")
+	if err := os.WriteFile(path, nil, 0o644); err != nil {
+		t.Fatalf("seed log: %v", err)
+	}
+	cs := &captureStore{}
+	ctx, cancel := context.WithCancel(context.Background())
+	done := make(chan error, 1)
+	go func() { done <- Run(ctx, path, cs, func() int { return 90 }, nil, nil) }()
+	time.Sleep(50 * time.Millisecond)
+	appendLine(t, path, "host postfix/smtp[1]: Q1: to=<a@example.net>, relay=x, dsn=2.0.0, status=sent (ok)")
+	waitFor(t, func() bool { return contains(cs.snapshot(), "Q1|a@example.net|sent") })
+
+	if err := os.Remove(path); err != nil {
+		t.Fatalf("remove: %v", err)
+	}
+	// blindness counts by the clock: the name must stay missing past blindMin.
+	time.Sleep(blindMin + 500*time.Millisecond)
+	if err := os.WriteFile(path, nil, 0o644); err != nil {
+		t.Fatalf("recreate: %v", err)
+	}
+	appendLine(t, path, "host postfix/smtp[1]: Q2: to=<b@example.net>, relay=x, dsn=5.1.1, status=bounced (nope)")
+	waitFor(t, func() bool { return contains(cs.snapshot(), "Q2|b@example.net|bounced") })
+	waitFor(t, func() bool {
+		cs.mu.Lock()
+		defer cs.mu.Unlock()
+		return len(cs.blind) == 1 && cs.blind[0] >= blindMin
+	})
+
+	cancel()
+	select {
+	case <-done:
+	case <-time.After(2 * time.Second):
+		t.Fatal("Run did not return after cancel")
+	}
+}
+
 // TestFollowResumesAfterRestart covers the persisted read offset: a restart
 // must parse the delivery lines written while the tailer was down (rows that
 // would otherwise stay "queued" forever), without re-parsing what it already

internal/milter/milter.go

@@ -1,14 +1,17 @@
-// Package milter implements the SelfPost journal-milter: a lightweight milter
-// (architecture.md § Mail path) attached to Postfix's smtpd_milters alongside
-// OpenDKIM. On the receive path it reads the SASL login, From, recipients and
+// Package milter implements the SelfPost milters: the journal-milter here, the
+// sender check (sender.go) and the inbound journal (inbound.go).
+//
+// The journal-milter is a lightweight milter (architecture.md § Mail path)
+// attached to Postfix's smtpd_milters alongside OpenDKIM. On the receive path it reads the SASL login, From, recipients and
 // Subject of each accepted message and records one send-log row per (queue-id,
 // recipient), giving the panel a structured, filterable history that raw
 // mail.log cannot.
 //
-// It is monitoring only: it never rejects, and every callback returns Continue
-// or Accept so a failure of this milter can never block the relay. Postfix is
-// configured with default_action=accept for this milter's socket, so even a
-// crash or hang fails open (architecture.md § Mail path).
+// It refuses only at MAIL FROM, with a 4xx tempfail, when a level-2 rate limit
+// or the application's client-address list says no (see MailFrom); every other
+// callback returns Continue. A failure of this milter never blocks the relay:
+// Postfix is configured with default_action=accept for this milter's socket,
+// so even a crash or hang fails open (architecture.md § Mail path).
 //
 // Postfix 3.7.11, src/milter/milter8.c, milter8_comm_error(): a milter that
 // cannot be reached, or does not answer within milter_*_timeout, gives no

internal/milter/sender.go

@@ -328,6 +328,11 @@ func (s *senderSession) Header(name, value string, m *milter.Modifier) (milter.R
 // src/cleanup/cleanup_milter.c, cleanup_milter_apply(): a "5" rejects the
 // message, and src/smtpd/smtpd.c, common_post_message_handling(), says that
 // reply to the client.
+//
+// h is not read: go-milter v0.4.1 adds every header of the connection to it
+// and empties it only on ABORT (session.go, CodeHeader, CodeAbort), so on a
+// second message it can still hold the first one's From:. The session keeps
+// its own, emptied at each MAIL FROM (audit 2026-10-12, L9).
 func (s *senderSession) Headers(h textproto.MIMEHeader, m *milter.Modifier) (milter.Response, error) {
 	shown, why, err := s.judge()
 	if err != nil {

internal/milter/sender_test.go

@@ -1,6 +1,7 @@
 package milter
 
 import (
+	"net/textproto"
 	"os"
 	"path/filepath"
 	"strconv"
@@ -301,15 +302,19 @@ func TestBindingsDuplicateKeyBreaksTheTable(t *testing.T) {
 	}
 }
 
-// A second message on the connection is judged by its own headers.
+// A second message on the connection is judged by its own headers - not by
+// the h go-milter passes, which still holds the earlier messages' From: (it
+// is emptied only on ABORT; audit 2026-10-12, L9).
 func TestSenderCheckResetsBetweenMessages(t *testing.T) {
 	bind := NewBindings(writeMaps(t, senderMaps))
 	s := &senderSession{bind: bind}
 	auth := mods(map[string]string{"{auth_authen}": "shop"})
+	h := textproto.MIMEHeader{}
 	for i, v := range []string{"director@example.org", "a@shop.example.org", "director@example.org"} {
 		_, _ = s.MailFrom("shop@shop.example.org", auth)
+		h.Add("From", v)
 		_, _ = s.Header("From", v, mods(nil))
-		resp, _ := s.Headers(nil, mods(nil))
+		resp, _ := s.Headers(h, mods(nil))
 		if passed := resp == milter.RespContinue; passed != (i == 1) {
 			t.Fatalf("message %d (From: %s): passed=%v", i, v, passed)
 		}

internal/store/inboundspam.go

@@ -356,8 +356,9 @@ type SpamListHit struct {
 
 // ListSpamListHits returns the journal rows of the filter in whose detail one
 // of the marks occurs - the marks the filter lists leave (internal/inbound).
-// Which entry a row belongs to is for the caller to work out; here the rows
-// are only narrowed, so that a page view does not read the whole journal.
+// Which entry a row belongs to is for the caller to work out. No index covers
+// detail or engine, so the query goes through the whole journal row by row and
+// returns the rspamd rows whose detail holds a mark.
 func (s *Store) ListSpamListHits(marks ...string) ([]SpamListHit, error) {
 	if len(marks) == 0 {
 		return nil, nil

internal/store/schema_test.go

@@ -12,8 +12,9 @@ import (
 )
 
 // 2.0 starts from one baseline: the 1.x chain is gone from the binary, not
-// carried along (docs/schema-migrations.md).
-func TestBaselineIsTheOnlyMigration(t *testing.T) {
+// carried along (docs/schema-migrations.md): the chain starts at the
+// baseline, and the baseline holds none of the 1.x schema.
+func TestChainStartsAtTheBaseline(t *testing.T) {
 	entries, err := fs.ReadDir(migrationsFS, "migrations")
 	if err != nil {
 		t.Fatalf("read migrations: %v", err)

internal/store/sendlog.go

@@ -16,10 +16,13 @@ const (
 	StatusSent     = "sent"
 	StatusDeferred = "deferred"
 	StatusBounced  = "bounced"
-	// StatusRejected marks a message the journal-milter refused with a 4xx under
-	// a level-2 rate limit (guide § Rate limiting). Such a row never gets a
-	// queue-id and is excluded from the level-2 message count (it was never
-	// sent).
+	// StatusRejected marks a message the relay refused, and the row of that
+	// refusal. The journal-milter refuses at MAIL FROM with a 4xx when a level-2
+	// rate limit or the application's client-address list says no (Reason is
+	// ReasonLimit or ReasonClient; such a row has no queue-id). The sender check
+	// refuses a From: line that is not the application's with a 550 (ReasonFrom;
+	// its row has the queue-id). Every refused row is left out of the level-2
+	// message count (it was never sent).
 	StatusRejected = "rejected"
 )
 
@@ -72,11 +75,11 @@ func (s *Store) InsertQueued(e SendLogEntry) error {
 	return nil
 }
 
-// InsertRejected records a message the journal-milter refused under a level-2
-// rate limit (guide § Rate limiting), so the rejection is visible in the
-// send-log UI. Only the fields known at MAIL FROM are set (domain, sender, app
-// login); there is no queue-id or recipient because the message was rejected
-// before it was queued.
+// InsertRejected records a refused message (StatusRejected), so the refusal is
+// visible in the send-log UI with its reason. The journal-milter writes its
+// MAIL FROM refusals with only the fields known there (domain, sender, app
+// login, client address): no queue-id, no recipient. The sender check writes
+// its From: refusals with the queue-id and the first recipient.
 func (s *Store) InsertRejected(e SendLogEntry) error {
 	now := time.Now().UTC().Format(time.RFC3339)
 	_, err := s.db.Exec(

internal/store/store.go

@@ -1,5 +1,5 @@
 // Package store owns the SelfPost SQLite database: the single file under /data
-// that persists panel users (global administrators and domain-admins), sending
+// that persists panel users (the global and domain roles), sending
 // domains and applications, optional inbound-relay domains, the send log and
 // rate-limit settings (architecture.md § Persistence). It exposes typed queries
 // so the rest of the panel never builds SQL by hand.

internal/web/guard_routes_test.go

@@ -22,7 +22,8 @@ var routes = struct{ always, inbound, dmarc []string }{
 	always: []string{
 		"GET /{$}",
 		"GET /overview", "GET /overview/fragment",
-		"GET /server/health", "POST /server/health/recheck", "POST /server/health/reload",
+		"GET /server/health", "GET /server/health/fragment",
+		"POST /server/health/recheck", "POST /server/health/reload",
 		"GET /outbound/domains", "POST /outbound/domains",
 		"GET /outbound/domains/{id}", "POST /outbound/domains/{id}/dns-recheck",
 		"GET /outbound/domains/{id}/settings",

internal/web/handlers/handlers_dmarc.go

@@ -17,11 +17,6 @@ import (
 // "custom" (an address typed for the domain). What is stored is the address
 // alone; "" is no reports.
 func (h *Handlers) HandleDomainDMARC(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		w.Header().Set("Allow", "POST")
-		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
-		return
-	}
 	d, ok := h.lookupDomain(w, r)
 	if !ok {
 		return

internal/web/handlers/handlers_settings.go

@@ -25,15 +25,12 @@ func (h *Handlers) HandleServerSettings(w http.ResponseWriter, r *http.Request)
 	if _, ok := h.requireGlobal(w, r); !ok {
 		return
 	}
-	switch r.Method {
-	case http.MethodGet:
-		h.renderServerSettings(w, r, http.StatusOK, "", h.currentRetentions())
-	case http.MethodPost:
+	// The routes are method-bound (GET and POST), so it is one or the other.
+	if r.Method == http.MethodPost {
 		h.submitServerSettings(w, r)
-	default:
-		w.Header().Set("Allow", "GET, POST")
-		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+		return
 	}
+	h.renderServerSettings(w, r, http.StatusOK, "", h.currentRetentions())
 }
 
 // retentions are the two journal retentions the Settings form shows: the

internal/web/handlers/handlers_users.go

@@ -67,15 +67,12 @@ func (h *Handlers) HandleUserNew(w http.ResponseWriter, r *http.Request) {
 	if _, ok := h.requireGlobal(w, r); !ok {
 		return
 	}
-	switch r.Method {
-	case http.MethodGet:
-		h.renderUserForm(w, r, http.StatusOK, 0, userFormView{FormRole: string(store.RoleDomain)})
-	case http.MethodPost:
+	// The routes are method-bound (GET and POST), so it is one or the other.
+	if r.Method == http.MethodPost {
 		h.submitUserCreate(w, r)
-	default:
-		w.Header().Set("Allow", "GET, POST")
-		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+		return
 	}
+	h.renderUserForm(w, r, http.StatusOK, 0, userFormView{FormRole: string(store.RoleDomain)})
 }
 
 // HandleUserEdit edits or deletes a panel user (global only).
@@ -97,24 +94,21 @@ func (h *Handlers) HandleUserEdit(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
 	}
-	switch r.Method {
-	case http.MethodGet:
-		h.renderUserForm(w, r, http.StatusOK, u.ID, userFormView{
-			FormUsername: u.Username,
-			FormEmail:    u.Email,
-			FormRole:     string(u.Role),
-			Reach:        u.Reach(),
-		})
-	case http.MethodPost:
+	// The routes are method-bound (GET and POST), so it is one or the other.
+	if r.Method == http.MethodPost {
 		if err := r.ParseForm(); err != nil {
 			h.renderUserForm(w, r, http.StatusBadRequest, u.ID, userFormView{FormErr: "Invalid form submission.", FormUsername: u.Username, FormEmail: u.Email, FormRole: string(u.Role)})
 			return
 		}
 		h.submitUserUpdate(w, r, u)
-	default:
-		w.Header().Set("Allow", "GET, POST")
-		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+		return
 	}
+	h.renderUserForm(w, r, http.StatusOK, u.ID, userFormView{
+		FormUsername: u.Username,
+		FormEmail:    u.Email,
+		FormRole:     string(u.Role),
+		Reach:        u.Reach(),
+	})
 }
 
 func (h *Handlers) renderUserForm(w http.ResponseWriter, r *http.Request, status int, userID int64, form userFormView) {

internal/web/home_test.go

@@ -3,6 +3,9 @@ package web
 import (
 	"net/http"
 	"net/http/httptest"
+	"os"
+	"regexp"
+	"slices"
 	"strings"
 	"testing"
 
@@ -61,3 +64,26 @@ func TestServerSubtreeIsGlobalOnly(t *testing.T) {
 		t.Fatalf("only %d /server/ routes were checked", checked)
 	}
 }
+
+// The test above walks the routes table; a /server/ route registered beside
+// it, or past the server() guard, would not be looked at. Every pattern under
+// /server/ that web.go registers goes through server() and is in the table.
+func TestEveryServerRouteIsGuardedAndListed(t *testing.T) {
+	src, err := os.ReadFile("web.go")
+	if err != nil {
+		t.Fatal(err)
+	}
+	found := regexp.MustCompile(`([\w.]+)\("((?:GET|POST|PUT|DELETE|PATCH|HEAD) )?(/server/[^"]*)"`).FindAllStringSubmatch(string(src), -1)
+	if len(found) < 15 {
+		t.Fatalf("only %d /server/ patterns found in web.go", len(found))
+	}
+	for _, m := range found {
+		pattern := m[2] + m[3]
+		if m[1] != "server" {
+			t.Errorf("%q is registered by %s, not server(): the subtree's guard is skipped", pattern, m[1])
+		}
+		if !slices.Contains(routes.always, pattern) {
+			t.Errorf("%q is not in routes.always, so no test opens it as a domain administrator", pattern)
+		}
+	}
+}

internal/web/security_test.go

@@ -64,6 +64,30 @@ func TestOriginCheck(t *testing.T) {
 	}
 }
 
+// A panel on a port of its own: the browser's Origin carries the port, as the
+// Host the proxy passes on does, and the two compare whole (Fetch Standard
+// § 3.2: the serialised origin has the port when it is not the scheme's
+// default). The same host on another port is another origin.
+func TestOriginCheckComparesThePort(t *testing.T) {
+	tests := []struct {
+		host, origin string
+		wantRejected bool
+	}{
+		{"panel.example.com:8443", "https://panel.example.com:8443", false},
+		{"panel.example.com:8443", "https://panel.example.com", true},
+		{"panel.example.com", "https://panel.example.com:8443", true},
+		{"panel.example.com:8443", "https://panel.example.com:9443", true},
+	}
+	for _, tc := range tests {
+		r := post("", tc.origin)
+		r.Host = tc.host
+		rejected := serveSecured(true, r).Code == http.StatusForbidden
+		if rejected != tc.wantRejected {
+			t.Errorf("Host %s, Origin %s: rejected = %t, want %t", tc.host, tc.origin, rejected, tc.wantRejected)
+		}
+	}
+}
+
 // The proxy terminates TLS and forwards plain HTTP, so the panel never learns
 // its own external scheme: comparing it against the https in Origin would
 // reject every legitimate form submission in the documented deployment.

internal/web/view/account.go

@@ -135,12 +135,7 @@ func (s *Settings) WithInbound(days string) *Settings {
 // WithResult shows the result of the last action, or its refusal, between the
 // head and the form.
 func (s *Settings) WithResult(flash, formErr string) *Settings {
-	switch {
-	case formErr != "":
-		s.Flash = &Flash{Error: true, Text: Plain(formErr)}
-	case flash != "":
-		s.Flash = &Flash{Text: Plain(flash)}
-	}
+	s.Flash = resultFlash(flash, formErr)
 	return s
 }
 

internal/web/view/components.go

@@ -449,16 +449,6 @@ type Fact struct {
 	Note  Text
 }
 
-// Facts is a shorthand for plain label / value pairs: Facts("Domain",
-// "example.org", "Port", "587").
-func Facts(pairs ...string) []Fact {
-	var out []Fact
-	for i := 0; i+1 < len(pairs); i += 2 {
-		out = append(out, Fact{Label: pairs[i], Value: Plain(pairs[i+1])})
-	}
-	return out
-}
-
 // SideMenu is the input of side_menu, the left column of a detail page: groups
 // of entries with icons and count tags.
 type SideMenu struct {

internal/web/view/components_test.go

@@ -311,9 +311,6 @@ func TestFactsBigMonoAndNote(t *testing.T) {
 		`<dl class="sp-facts"><div><dt>Domain</dt><dd><a href="/outbound/domains/1">example.org</a></dd></div>`,
 		`<dd class="sp-mono">4XcB7k2Jm9z1</dd>`,
 		`<dd class="sp-big">5 days</dd><dd class="sp-muted">a supporting line</dd>`)
-	if got := Facts("A", "1", "B", "2", "odd"); len(got) != 2 || got[1].Label != "B" {
-		t.Errorf("Facts(pairs) = %#v", got)
-	}
 }
 
 func TestSideMenu(t *testing.T) {