release: 1.2.0: Panel 1.2.0-1.2.5: layout, RBAC, tests, GUI and CI fixes

[1.2.0]
The second MINOR after 1.0.0: domain administrators with per-domain scope, a panel visual refresh on the SelfPost palette, and refinements to navigation and the send log. Upgrading runs one SQLite migration (`0005_panel_users`); the single administrator becomes a global user.
Added:
  - panel: **domain-admin role** — global administrators manage panel users and
Fixed:
  - Docker build: `LICENSE` is no longer excluded by `.dockerignore`, so the
  - panel: on signed-in pages with a narrow card (**Settings**, the user form)
Changed:
  - panel: navigation session icons are distinct — **Settings** uses a gear,
  - panel: `/` redirects domain administrators to `/domains`; global users still
  - panel: **Sign out** in the navigation column uses the same type size and
  - panel: **visual style** brought in line with the SelfPost mark — brick accent
  - panel: the send log's **status is a badge**, in the same ok/warn/error/unknown
  … (1 more in CHANGELOG)
[1.2.1]
Panel refinements after 1.2.0: navigation icons, status-badge centreing, drill-down back-link placement, and safeguards for the sole global administrator. Upgrading is a tag bump; no migration.
Fixed:
  - panel: status badge text sat low in the box (and below the heading or label
  - panel: the **Users** navigation icon was two full silhouettes with staggered
  - panel: the **Settings** navigation icon was a sun-with-rays (circle plus
  - panel: the user create/edit form placed «Back to users» at the bottom of the
Changed:
  - panel: the user edit form disables role change and delete for the only global
  - panel: the user create/edit form hides **Assigned domains** when the role is
  - panel: **Settings** shows panel credentials and DMARC aggregate reports side
[1.2.2]
Status page layout after 1.2.1: paired cards in a wide column, denser machine and check copy, and a user-form checkbox fix. Upgrading is a tag bump; no migration.
Changed:
  - panel: **Status** is wide again so paired cards fill the column. Layout:
Fixed:
  - panel: cards inside `.split` used `margin: 0 auto`, which in a CSS grid
  - panel: on the user create/edit form, **Assigned domains** checkboxes stacked
[1.2.3]
Domain detail layout and panel polish after 1.2.2. Upgrading is a tag bump; no migration.
Changed:
  - panel: the domain detail page is wide with paired cards (DKIM+SPF ‖ DMARC;
  - panel: Domains list — **Add domain** sits beside the domain field; the
  - panel: page URLs, browser titles, and headings are aligned — **Settings** is
Fixed:
  - image: `mail.log` rotation no longer silently stops when the build context
[1.2.4]
Level-2 rate-limit semantics inverted after 1.2.3, plus a small DNS field height fix. Upgrading is a tag bump; no migration.
Changed:
  - rate limiting (level 2): domain ceilings apply to every client IP (no IP
Fixed:
  - panel: on the domain DNS status grid, the Type (TXT) field height matches
[1.2.5]
Rate-limit form polish after 1.2.4. Upgrading is a tag bump; no migration.
Changed:
  - panel: rate-limit forms refined — level-1 backstop as muted copy on the

Squashed CHANGELOG sections: [1.2.0], [1.2.1], [1.2.2], [1.2.3], [1.2.4], [1.2.5].

Full detail: CHANGELOG.md (1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.5).

internal/web/handlers/handlers_domains.go

@@ -29,27 +29,31 @@ func (h *Handlers) HandleDashboard(w http.ResponseWriter, r *http.Request) {
 }
 
 func (h *Handlers) renderDashboard(w http.ResponseWriter, r *http.Request, status int, formErr, formName string) {
-	domains, err := h.domains.List()
+	p, ok := h.principal(r)
+	if !ok {
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	domains, err := h.assignedDomains(p)
 	if err != nil {
 		logf("panel: dashboard: list domains: %v", err)
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
 	}
-	h.view.Render(w, status, "dashboard", map[string]any{
-		"Title":    "SelfPost",
-		"User":     auth.CurrentUser(r),
-		"Active":   "domains",
-		"Domains":  h.domainRows(domains),
-		"Error":    formErr,
-		"FormName": formName,
-		"Flash":    dashboardFlash(r),
-	})
+	data := h.pageBase(r)
+	data["Title"] = "SelfPost — domains"
+	data["Active"] = "domains"
+	data["Domains"] = h.domainRows(domains)
+	data["Error"] = formErr
+	data["FormName"] = formName
+	data["Flash"] = dashboardFlash(r)
+	h.view.Render(w, status, "dashboard", data)
 }
 
 func (h *Handlers) domainRows(domains []store.Domain) []domainRow {
 	profileEmail := ""
-	if admin, err := h.store.GetAdmin(); err == nil {
-		profileEmail = admin.DMARCReportEmail
+	if email, err := h.store.GlobalDMARCReportEmail(); err == nil {
+		profileEmail = email
 	}
 	rows := make([]domainRow, len(domains))
 	var wg sync.WaitGroup
@@ -82,6 +86,9 @@ func dashboardFlash(r *http.Request) string {
 // OpenDKIM reload), and redirects to the domain's page so the DNS record to
 // publish is shown (product.md).
 func (h *Handlers) HandleAddDomain(w http.ResponseWriter, r *http.Request) {
+	if _, ok := h.requireGlobal(w, r); !ok {
+		return
+	}
 	if err := r.ParseForm(); err != nil {
 		h.renderDashboard(w, r, http.StatusBadRequest, "Invalid form submission.", "")
 		return
@@ -109,6 +116,9 @@ func (h *Handlers) HandleAddDomain(w http.ResponseWriter, r *http.Request) {
 
 // HandleDeleteConfirm shows the cascade warning before a domain is removed.
 func (h *Handlers) HandleDeleteConfirm(w http.ResponseWriter, r *http.Request) {
+	if _, ok := h.requireGlobal(w, r); !ok {
+		return
+	}
 	d, ok := h.lookupDomain(w, r)
 	if !ok {
 		return
@@ -118,11 +128,15 @@ func (h *Handlers) HandleDeleteConfirm(w http.ResponseWriter, r *http.Request) {
 		"User":   auth.CurrentUser(r),
 		"Active": "domains",
 		"Domain": d,
+		"IsGlobal": true,
 	})
 }
 
 // HandleDeleteDomain performs the deletion and returns to the domain list.
 func (h *Handlers) HandleDeleteDomain(w http.ResponseWriter, r *http.Request) {
+	if _, ok := h.requireGlobal(w, r); !ok {
+		return
+	}
 	id, ok := parseDomainID(w, r)
 	if !ok {
 		return
@@ -145,6 +159,9 @@ func (h *Handlers) HandleDeleteDomain(w http.ResponseWriter, r *http.Request) {
 // HandleReload re-applies both the OpenDKIM configuration and the Postfix
 // sender map on demand (architecture.md § Panel HTTP surface).
 func (h *Handlers) HandleReload(w http.ResponseWriter, r *http.Request) {
+	if _, ok := h.requireGlobal(w, r); !ok {
+		return
+	}
 	if err := h.domains.Resync(); err != nil {
 		logf("panel: manual reload (opendkim): %v", err)
 		http.Error(w, "reload failed", http.StatusInternalServerError)
@@ -173,6 +190,11 @@ func (h *Handlers) lookupDomain(w http.ResponseWriter, r *http.Request) (store.D
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return store.Domain{}, false
 	}
+	p, ok := h.principal(r)
+	if !ok || !p.CanAccessDomain(d.ID) {
+		http.NotFound(w, r)
+		return store.Domain{}, false
+	}
 	return d, true
 }