release: 1.2.0: Panel 1.2.0-1.2.5: layout, RBAC, tests, GUI and CI fixes

[1.2.0]
The second MINOR after 1.0.0: domain administrators with per-domain scope, a panel visual refresh on the SelfPost palette, and refinements to navigation and the send log. Upgrading runs one SQLite migration (`0005_panel_users`); the single administrator becomes a global user.
Added:
  - panel: **domain-admin role** — global administrators manage panel users and
Fixed:
  - Docker build: `LICENSE` is no longer excluded by `.dockerignore`, so the
  - panel: on signed-in pages with a narrow card (**Settings**, the user form)
Changed:
  - panel: navigation session icons are distinct — **Settings** uses a gear,
  - panel: `/` redirects domain administrators to `/domains`; global users still
  - panel: **Sign out** in the navigation column uses the same type size and
  - panel: **visual style** brought in line with the SelfPost mark — brick accent
  - panel: the send log's **status is a badge**, in the same ok/warn/error/unknown
  … (1 more in CHANGELOG)
[1.2.1]
Panel refinements after 1.2.0: navigation icons, status-badge centreing, drill-down back-link placement, and safeguards for the sole global administrator. Upgrading is a tag bump; no migration.
Fixed:
  - panel: status badge text sat low in the box (and below the heading or label
  - panel: the **Users** navigation icon was two full silhouettes with staggered
  - panel: the **Settings** navigation icon was a sun-with-rays (circle plus
  - panel: the user create/edit form placed «Back to users» at the bottom of the
Changed:
  - panel: the user edit form disables role change and delete for the only global
  - panel: the user create/edit form hides **Assigned domains** when the role is
  - panel: **Settings** shows panel credentials and DMARC aggregate reports side
[1.2.2]
Status page layout after 1.2.1: paired cards in a wide column, denser machine and check copy, and a user-form checkbox fix. Upgrading is a tag bump; no migration.
Changed:
  - panel: **Status** is wide again so paired cards fill the column. Layout:
Fixed:
  - panel: cards inside `.split` used `margin: 0 auto`, which in a CSS grid
  - panel: on the user create/edit form, **Assigned domains** checkboxes stacked
[1.2.3]
Domain detail layout and panel polish after 1.2.2. Upgrading is a tag bump; no migration.
Changed:
  - panel: the domain detail page is wide with paired cards (DKIM+SPF ‖ DMARC;
  - panel: Domains list — **Add domain** sits beside the domain field; the
  - panel: page URLs, browser titles, and headings are aligned — **Settings** is
Fixed:
  - image: `mail.log` rotation no longer silently stops when the build context
[1.2.4]
Level-2 rate-limit semantics inverted after 1.2.3, plus a small DNS field height fix. Upgrading is a tag bump; no migration.
Changed:
  - rate limiting (level 2): domain ceilings apply to every client IP (no IP
Fixed:
  - panel: on the domain DNS status grid, the Type (TXT) field height matches
[1.2.5]
Rate-limit form polish after 1.2.4. Upgrading is a tag bump; no migration.
Changed:
  - panel: rate-limit forms refined — level-1 backstop as muted copy on the

Squashed CHANGELOG sections: [1.2.0], [1.2.1], [1.2.2], [1.2.3], [1.2.4], [1.2.5].

Full detail: CHANGELOG.md (1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.5).

internal/web/handlers/handlers_apps.go

@@ -10,7 +10,6 @@ import (
 	"github.com/mixeme/selfpost/internal/dnscheck"
 	"github.com/mixeme/selfpost/internal/domain"
 	"github.com/mixeme/selfpost/internal/store"
-	"github.com/mixeme/selfpost/internal/web/auth"
 	"github.com/mixeme/selfpost/internal/web/validate"
 )
 
@@ -104,13 +103,12 @@ func (h *Handlers) renderDomainDetail(w http.ResponseWriter, r *http.Request, st
 	// What DNS actually publishes for the domain today, checked against the key
 	// this server signs with. Cached by the checker, so re-rendering the page
 	// after a form post costs nothing.
-	admin, err := h.store.GetAdmin()
+	profileEmail, err := h.store.GlobalDMARCReportEmail()
 	if err != nil {
-		logf("panel: domain %d: get admin: %v", d.ID, err)
+		logf("panel: domain %d: global dmarc email: %v", d.ID, err)
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
 	}
-	profileEmail := admin.DMARCReportEmail
 	reportEmail := dnscheck.ResolveDMARCRua(d.DMARCRua, profileEmail)
 	dns, srv := h.domainDNS(d, record, profileEmail, false)
 	reportAuthName, reportAuthValue, needsReportAuth := dnscheck.ExternalReportAuth(d.Name, reportEmail)
@@ -134,52 +132,45 @@ func (h *Handlers) renderDomainDetail(w http.ResponseWriter, r *http.Request, st
 		dmarcSource = "settings"
 	}
 
-	h.view.Render(w, status, "domain_detail", map[string]any{
-		"Title":  "SelfPost — " + d.Name,
-		"User":   auth.CurrentUser(r),
-		"Active": "domains",
-		"Domain": d,
-		"Record": record,
-		"DNS":    dns,
-		// SPF and DMARC are the operator's to write — SelfPost cannot generate
-		// them the way it generates the DKIM record — so the page shows what
-		// this server expects rather than leaving it to the documentation. The
-		// same builders phrase the suggestions in the check messages, so the
-		// page and the checks below it never recommend different records.
-		"SPFExample":   dnscheck.SPFExample(h.cfg.Hostname, srv.IPs),
-		"DMARCName":    dnscheck.DMARCRecordName(d.Name),
-		"DMARCExample":      dnscheck.DMARCExample(reportEmail),
-		"DMARCSource":       dmarcSource,
-		"ProfileDMARCEmail": profileEmail,
-		"ResolvedDMARCEmail": reportEmail,
-		"DMARCRuaMode":      dmarcMode,
-		"DMARCRuaCustom":    dmarcCustom,
-		"ReportAuthName":    reportAuthName,
-		"ReportAuthValue":   reportAuthValue,
-		"NeedsReportAuth":   needsReportAuth,
-		"SameDomainRUA":     reportEmail != "" && strings.EqualFold(dnscheck.EmailDomain(reportEmail), d.Name),
-		// Client connection settings (the same for every domain on this
-		// instance): the hostname clients connect to, and whether the optional
-		// submission listener is enabled in this deployment.
-		"Hostname":          h.cfg.Hostname,
-		"SubmissionEnabled": h.cfg.SubmissionEnabled,
-		"Apps":              appViews,
-		"Error":             view.FormErr,
-		"FormLogin":         view.FormLogin,
-		"FormMode":          view.FormMode,
-		"FormAddrs":         view.FormAddrs,
-		"NewCred":           view.NewCred,
-		"Flash":             detailFlash(r),
-		"Wildcard":          store.AddressModeWildcard,
-		"List":              store.AddressModeList,
-		"RateLimitErr":      view.RateLimitErr,
-		"ExportErr":         view.ExportErr,
-		"MinPwLen":          validate.MinSecretFilePasswordLen,
-		"DomainHasRL":       domainRLok && domainRL.Active(),
-		"DomainRLIPs":       strings.Join(domainRL.AllowedIPs, "\n"),
-		"DomainRLMax":       intOrBlank(domainRL.MaxMessages),
-		"DomainRLWin":       windowOrDefault(domainRL.WindowSeconds),
-	})
+	data := h.pageBase(r)
+	data["Title"] = "SelfPost — " + d.Name
+	data["Active"] = "domains"
+	data["Domain"] = d
+	data["Record"] = record
+	data["DNS"] = dns
+	data["SPFExample"] = dnscheck.SPFExample(h.cfg.Hostname, srv.IPs)
+	data["DMARCName"] = dnscheck.DMARCRecordName(d.Name)
+	data["DMARCExample"] = dnscheck.DMARCExample(reportEmail)
+	data["DMARCSource"] = dmarcSource
+	data["ProfileDMARCEmail"] = profileEmail
+	data["ResolvedDMARCEmail"] = reportEmail
+	data["DMARCRuaMode"] = dmarcMode
+	data["DMARCRuaCustom"] = dmarcCustom
+	data["ReportAuthName"] = reportAuthName
+	data["ReportAuthValue"] = reportAuthValue
+	data["NeedsReportAuth"] = needsReportAuth
+	data["SameDomainRUA"] = reportEmail != "" && strings.EqualFold(dnscheck.EmailDomain(reportEmail), d.Name)
+	data["Hostname"] = h.cfg.Hostname
+	data["SubmissionEnabled"] = h.cfg.SubmissionEnabled
+	data["Apps"] = appViews
+	data["Error"] = view.FormErr
+	data["FormLogin"] = view.FormLogin
+	data["FormMode"] = view.FormMode
+	data["FormAddrs"] = view.FormAddrs
+	data["NewCred"] = view.NewCred
+	data["Flash"] = detailFlash(r)
+	data["Wildcard"] = store.AddressModeWildcard
+	data["List"] = store.AddressModeList
+	data["RateLimitErr"] = view.RateLimitErr
+	data["ExportErr"] = view.ExportErr
+	data["MinPwLen"] = validate.MinSecretFilePasswordLen
+	data["DomainHasRL"] = domainRLok && domainRL.Active()
+	data["DomainRLMax"] = intOrBlank(domainRL.MaxMessages)
+	data["DomainRLWin"] = windowOrDefault(domainRL.WindowSeconds)
+	data["DomainRLMaxNum"] = domainRL.MaxMessages
+	data["L1Messages"] = h.l1Messages()
+	data["L1Window"] = h.l1Window()
+	h.view.Render(w, status, "domain_detail", data)
 }
 
 // domainDNS resolves what the world sees for a domain: its DKIM, SPF and DMARC
@@ -213,13 +204,13 @@ func (h *Handlers) HandleDomainDNSRecheck(w http.ResponseWriter, r *http.Request
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
 	}
-	admin, err := h.store.GetAdmin()
+	profileEmail, err := h.store.GlobalDMARCReportEmail()
 	if err != nil {
-		logf("panel: domain %d: get admin: %v", d.ID, err)
+		logf("panel: domain %d: global dmarc email: %v", d.ID, err)
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
 	}
-	h.domainDNS(d, record, admin.DMARCReportEmail, true)
+	h.domainDNS(d, record, profileEmail, true)
 	http.Redirect(w, r, fmt.Sprintf("/domains/%d?rechecked=1", d.ID), http.StatusSeeOther)
 }
 
@@ -387,6 +378,11 @@ func (h *Handlers) lookupApplication(w http.ResponseWriter, r *http.Request) (st
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return store.Application{}, false
 	}
+	p, ok := h.principal(r)
+	if !ok || !p.CanAccessApp(a) {
+		http.NotFound(w, r)
+		return store.Application{}, false
+	}
 	return a, true
 }