panel-redesign: Inbound domains, domain and delete on the kit; Spam filter box

Stage 2, step 5. Written by Sonnet, reviewed by Opus.

  - Three pages named after their mockups: in-domains, in-domain,
    in-domain-delete, with typed page data (view/inbound.go), fixtures
    and tests. The engine pages inbound, inbound_domain and
    inbound_delete are gone with their templates and are off
    legacy_pages.txt.
  - The Spam filter box (plan, Who sees what). The panel now reads
    INBOUND_ANTISPAM_MILTER and INBOUND_ANTISPAM_MILTER_ACTION, with the
    semantics of build/postfix-config.sh (on only with the inbound relay
    on and a milter set; accept | tempfail). It reports them, nothing
    more:
      on   Applies to / Filter (the address, global role only) / If the
           filter is down (accepted unfiltered | deferred)
      off  one sentence; the variable is named for the global role only
    The list shows "Spam filter on|off" in its head.
  - Handlers pass typed data; routes, POST targets, field names,
    validation and authorization (global: all inbound domains; domain
    role: the assigned ones, another tenant's id is a 404; add and
    delete are global-only) are unchanged. A test saves the upstream and
    recipients forms untouched and finds the domain unchanged.

Left out of the mockups' Spam filter box and menu - no source before
inbound-antispam-panel (2.1): the engine name, the quarantine row, the
"refused at the door, see the log" row, the lists row, "Log for this
domain". Also "Checked N min ago" on the MX box: the check carries no
time.

Not done: the filter's socket on Health and Overview. internal/health
checks a unix socket by stat; the documented form of the filter's
address is inet:host:port and needs a dial that does not exist yet.

Differences from the mockups, for the owner:
  - refusals and confirmations are the kit flash above the boxes;
  - the MX tag is coloured by the check in every state; an MX that
    points elsewhere shows "In DNS now";
  - the lead of the domain page follows what is saved ("Not accepting
    mail yet: no upstream is saved");
  - the delete page lists only what the domain has;
  - /help#inbound opens Help at the top until the Help step.

Evidence
  - docs/assets/panel-redesign/evidence/in-domains.png, in-domain.png,
    in-domain-delete.png: 1440 px wide, headless Edge, real templates
    served locally with their fixtures (filter on) - NOT from the
    container (no Docker on this machine).
  - panel/audit.js on the three pages at 1440 and 1280: 352 texts
    checked, problems: [].
  - That the panel process sees the two variables inside the container
    is read from supervisord.conf and entrypoint.sh, not run.
  - go test -count=1 ./internal/web/... ./cmd/panel
      ok  internal/web
      ok  internal/web/auth
      ok  internal/web/handlers
      ok  internal/web/validate
      ok  internal/web/view
      ok  cmd/panel

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/handlers/handlers.go

@@ -39,6 +39,12 @@ type Config struct {
 	// InboundEnabled mirrors INBOUND_RELAY_ENABLE: the inbound panel and
 	// routes exist only when this is true.
 	InboundEnabled bool
+	// InboundAntispamMilter mirrors INBOUND_ANTISPAM_MILTER and
+	// InboundAntispamAction INBOUND_ANTISPAM_MILTER_ACTION ("accept",
+	// "tempfail", or "" for a value build/postfix-config.sh would refuse). The
+	// filter is on only when the inbound relay is on and the milter is set.
+	InboundAntispamMilter string
+	InboundAntispamAction string
 	// DMARCEnabled mirrors DMARC_REPORTS_ENABLE.
 	DMARCEnabled bool
 	// SendLogRetentionEnvDefault is SEND_LOG_RETENTION_DAYS at panel start; used

internal/web/handlers/handlers_delegation_test.go

@@ -224,7 +224,7 @@ func TestInboundListShowsOnlyTheAssignedDomains(t *testing.T) {
 	if !strings.Contains(body, "a.example.com") || strings.Contains(body, "b.example.com") {
 		t.Errorf("the administrator of A must see A and not B:\n%s", body)
 	}
-	for _, globalOnly := range []string{"Add inbound domain", "/delete"} {
+	for _, globalOnly := range []string{"Add a domain", "/delete"} {
 		if strings.Contains(body, globalOnly) {
 			t.Errorf("the list offers a domain administrator %q", globalOnly)
 		}
@@ -249,7 +249,7 @@ func TestInboundListShowsOnlyTheAssignedDomains(t *testing.T) {
 			t.Errorf("list with %s = %d, want 404", who, rec.Code)
 		}
 	}
-	if body := list(&s.global).Body.String(); !strings.Contains(body, "Add inbound domain") || !strings.Contains(body, "b.example.com") {
+	if body := list(&s.global).Body.String(); !strings.Contains(body, "Add a domain") || !strings.Contains(body, "b.example.com") {
 		t.Errorf("the global role lost the full list or the add form:\n%s", body)
 	}
 }

internal/web/handlers/handlers_inbound.go

@@ -5,7 +5,6 @@ import (
 	"fmt"
 	"net/http"
 	"strconv"
-	"strings"
 	"sync"
 
 	"github.com/mixeme/selfpost/internal/dnscheck"
@@ -13,16 +12,9 @@ import (
 	"github.com/mixeme/selfpost/internal/store"
 	"github.com/mixeme/selfpost/internal/web/auth"
 	"github.com/mixeme/selfpost/internal/web/validate"
+	"github.com/mixeme/selfpost/internal/web/view"
 )
 
-type inboundRow struct {
-	store.InboundDomain
-	DNS       health.Status
-	Upstream  string
-	TLSLabel  string
-	RcptLabel string
-}
-
 // Inbound is delegated to domain administrators separately from outbound (plan
 // § Who sees what), so its handlers come in three strengths:
 //
@@ -124,34 +116,37 @@ func (h *Handlers) renderInboundList(w http.ResponseWriter, r *http.Request, sta
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
 	}
-	data := h.pageBase(r)
-	data["Title"] = "SelfPost — inbound"
-	data["Active"] = "inbound"
-	data["Domains"] = h.inboundRows(list)
-	data["Error"] = formErr
-	data["FormName"] = formName
+	flash := ""
 	if r.URL.Query().Get("deleted") != "" {
-		data["Flash"] = "Inbound domain deleted."
+		flash = "Inbound domain deleted."
 	}
-	h.view.Render(w, status, "inbound", data)
+	on, _, _ := h.inboundFilter()
+	page := view.NewInDomains(h.shellMeta(r), p.IsGlobal()).
+		WithFilter(on).
+		WithRows(h.inboundRows(list, p.IsGlobal())).
+		WithResult(flash, formErr, formName)
+	h.view.Render(w, status, "in-domains", page)
 }
 
-func (h *Handlers) inboundRows(domains []store.InboundDomain) []inboundRow {
-	rows := make([]inboundRow, len(domains))
+// inboundRows is one row per inbound domain: the verdict of the MX check
+// (cached for a few minutes, as on the domain page), the upstream, who is
+// accepted and the TLS to the upstream. The checks run side by side.
+func (h *Handlers) inboundRows(domains []store.InboundDomain, canDelete bool) []view.InDomainRow {
+	rows := make([]view.InDomainRow, len(domains))
 	var wg sync.WaitGroup
 	for i, d := range domains {
-		rows[i] = inboundRow{
-			InboundDomain: d,
-			DNS:           health.StatusUnknown,
-			Upstream:      inboundUpstream(d),
-			TLSLabel:      tlsLabel(d.TLSMode),
-			RcptLabel:     rcptLabel(d),
+		in := view.InDomainInput{
+			ID: d.ID, Name: d.Name, DNSStatus: string(health.StatusUnknown),
+			Host: d.Host, Port: d.Port, TLSMode: d.TLSMode,
+			RecipientMode: d.RecipientMode, RecipientCount: d.RecipientCount,
 		}
+		rows[i] = view.NewInDomainRow(in, canDelete)
 		wg.Add(1)
 		go func() {
 			defer wg.Done()
 			if h.dns != nil && h.cfg.Hostname != "" {
-				rows[i].DNS = h.dns.InboundMX(d.Name, h.cfg.Hostname, false).Status
+				in.DNSStatus = string(h.dns.InboundMX(d.Name, h.cfg.Hostname, false).Status)
+				rows[i] = view.NewInDomainRow(in, canDelete)
 			}
 		}()
 	}
@@ -159,42 +154,6 @@ func (h *Handlers) inboundRows(domains []store.InboundDomain) []inboundRow {
 	return rows
 }
 
-func inboundUpstream(d store.InboundDomain) string {
-	if d.Host == "" {
-		return "—"
-	}
-	return fmt.Sprintf("%s:%d", d.Host, d.Port)
-}
-
-func tlsLabel(mode string) string {
-	switch mode {
-	case store.TLSModeEncrypt:
-		return "required"
-	case store.TLSModeNone:
-		return "off"
-	default:
-		return "opportunistic"
-	}
-}
-
-func tlsStatusClass(mode string) string {
-	if mode == store.TLSModeEncrypt {
-		return "ok"
-	}
-	return "unknown"
-}
-
-func rcptLabel(d store.InboundDomain) string {
-	if d.RecipientMode == store.RecipientModeAny {
-		return "any"
-	}
-	n := d.RecipientCount
-	if n == 1 {
-		return "1 listed"
-	}
-	return fmt.Sprintf("%d listed", n)
-}
-
 // HandleAddInbound validates the name, creates the inbound domain, and
 // redirects to its page.
 func (h *Handlers) HandleAddInbound(w http.ResponseWriter, r *http.Request) {
@@ -244,21 +203,35 @@ func (h *Handlers) renderInboundDetail(w http.ResponseWriter, r *http.Request, s
 	if h.dns != nil && h.cfg.Hostname != "" {
 		mx = h.dns.InboundMX(d.Name, h.cfg.Hostname, false)
 	}
-	data := h.pageBase(r)
-	data["Title"] = "SelfPost — " + d.Name
-	data["Active"] = "inbound"
-	data["Domain"] = d
-	data["MX"] = mx
-	data["MXValue"] = "10 " + strings.TrimSuffix(h.cfg.Hostname, ".") + "."
-	data["Hostname"] = h.cfg.Hostname
-	data["TLSLabel"] = tlsLabel(d.TLSMode)
-	data["TLSClass"] = tlsStatusClass(d.TLSMode)
-	data["RecipientText"] = strings.Join(d.Recipients, "\n")
-	data["Flash"] = inboundFlash(r)
-	data["FormErr"] = extra.FormErr
-	data["TransportErr"] = extra.TransportErr
-	data["RecipientErr"] = extra.RecipientErr
-	h.view.Render(w, status, "inbound_domain", data)
+	on, milter, action := h.inboundFilter()
+	page := view.NewInDomain(h.shellMeta(r), view.InDomainInput{
+		ID: d.ID, Name: d.Name, DNSStatus: string(mx.Status), Host: d.Host, Port: d.Port, TLSMode: d.TLSMode,
+		RecipientMode: d.RecipientMode, RecipientCount: d.RecipientCount, Addresses: d.Recipients,
+	}).
+		WithMX(h.cfg.Hostname, view.DNSCheck{Status: string(mx.Status), Detail: mx.Detail, Found: mx.Records}).
+		WithFilter(on, milter, action).
+		WithResult(inboundFlash(r), firstNonEmpty(extra.FormErr, extra.TransportErr, extra.RecipientErr))
+	h.view.Render(w, status, "in-domain", page)
+}
+
+// inboundFilter says whether the instance filters inbound mail, and with what:
+// the milter address and what Postfix does when it is down. It mirrors
+// build/postfix-config.sh, which attaches the filter only when the inbound
+// relay is on and a milter is set.
+func (h *Handlers) inboundFilter() (on bool, milter, action string) {
+	if !h.cfg.InboundEnabled || h.cfg.InboundAntispamMilter == "" {
+		return false, "", ""
+	}
+	return true, h.cfg.InboundAntispamMilter, h.cfg.InboundAntispamAction
+}
+
+func firstNonEmpty(ss ...string) string {
+	for _, s := range ss {
+		if s != "" {
+			return s
+		}
+	}
+	return ""
 }
 
 func inboundFlash(r *http.Request) string {
@@ -330,12 +303,12 @@ func (h *Handlers) HandleInboundDeleteConfirm(w http.ResponseWriter, r *http.Req
 	if !ok {
 		return
 	}
-	data := h.pageBase(r)
-	data["Title"] = "SelfPost — delete " + d.Name
-	data["Active"] = "inbound"
-	data["Domain"] = d
-	data["Upstream"] = inboundUpstream(d)
-	h.view.Render(w, http.StatusOK, "inbound_delete", data)
+	listed := 0
+	if d.RecipientMode != store.RecipientModeAny {
+		listed = d.RecipientCount
+	}
+	h.view.Render(w, http.StatusOK, "in-domain-delete",
+		view.NewInDomainDelete(h.shellMeta(r), d.ID, d.Name, d.Host != "", listed))
 }
 
 func (h *Handlers) HandleInboundDelete(w http.ResponseWriter, r *http.Request) {

internal/web/handlers/handlers_inbound_domain_test.go

@@ -0,0 +1,130 @@
+package handlers
+
+import (
+	"net/http"
+	"net/url"
+	"reflect"
+	"testing"
+)
+
+// The page of one inbound domain is filled from the store, the DNS checker and
+// the filter settings; each form's refusal comes back on it as a flash.
+func TestInboundDomainPageFromTheStore(t *testing.T) {
+	h, st := inboundHandlers(t)
+	d, err := st.AddInboundDomain("lists.example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+	id := itoa(d.ID)
+	if err := h.inbound.SetTransport(d.ID, "mx.internal", "2525", "encrypt"); err != nil {
+		t.Fatal(err)
+	}
+	if err := h.inbound.SetRecipients(d.ID, "list", []string{"a@lists.example.com", "b@lists.example.com"}); err != nil {
+		t.Fatal(err)
+	}
+
+	body := inboundCall(h, http.MethodGet, "/inbound/domains/"+id, nil, globalPrincipal).Body.String()
+	has(t, "domain page", body, `<h1 class="title is-3">lists.example.com</h1>`,
+		`handed to <span class="sp-mono">mx.internal:2525</span> over required TLS · 2 recipients`,
+		`value="10 mail.example.org."`, `name="host" value="mx.internal"`, `value="2525"`,
+		`<option value="encrypt" selected>Required</option>`, "a@lists.example.com\nb@lists.example.com",
+		`action="/inbound/domains/`+id+`/upstream"`, `action="/inbound/domains/`+id+`/recipients"`,
+		`action="/inbound/domains/`+id+`/dns-recheck"`, `href="/inbound/domains/`+id+`/delete"`)
+
+	rec := inboundCall(h, http.MethodPost, "/inbound/domains/"+id+"/upstream", url.Values{
+		"host": {""}, "port": {"25"}, "tls_mode": {"may"}}, globalPrincipal)
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("empty host = %d, want 400", rec.Code)
+	}
+	has(t, "refused upstream", rec.Body.String(), `<div class="notification is-danger is-light">`, `name="host" value="mx.internal"`)
+
+	rec = inboundCall(h, http.MethodPost, "/inbound/domains/"+id+"/recipients", url.Values{
+		"recipient_mode": {"list"}, "addresses": {"x@other.example"}}, globalPrincipal)
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("foreign recipient = %d, want 400", rec.Code)
+	}
+	has(t, "refused recipients", rec.Body.String(), `<div class="notification is-danger is-light">`, "a@lists.example.com\nb@lists.example.com")
+
+	body = send(h.HandleInboundDetail, &globalPrincipal, http.MethodGet, "/inbound/domains/"+id+"?saved=1", map[string]string{"id": id}, nil).Body.String()
+	has(t, "after saving", body, `<div class="notification is-success is-light">`, `Upstream saved.`)
+}
+
+// Saving either form untouched, with the values the page sends back, stores
+// exactly what was stored.
+func TestInboundDomainFormsSaveUntouchedUnchanged(t *testing.T) {
+	h, st := inboundHandlers(t)
+	d, err := st.AddInboundDomain("lists.example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+	id := itoa(d.ID)
+	if err := h.inbound.SetTransport(d.ID, "mx.internal", "2525", "none"); err != nil {
+		t.Fatal(err)
+	}
+	if err := h.inbound.SetRecipients(d.ID, "list", []string{"a@lists.example.com", "b@lists.example.com"}); err != nil {
+		t.Fatal(err)
+	}
+	before, err := st.GetInboundDomain(d.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if rec := inboundCall(h, http.MethodPost, "/inbound/domains/"+id+"/upstream", url.Values{
+		"host": {before.Host}, "port": {itoa(int64(before.Port))}, "tls_mode": {before.TLSMode}}, globalPrincipal); rec.Code != http.StatusSeeOther {
+		t.Fatalf("upstream = %d %s", rec.Code, rec.Body.String())
+	}
+	if rec := inboundCall(h, http.MethodPost, "/inbound/domains/"+id+"/recipients", url.Values{
+		"recipient_mode": {before.RecipientMode}, "addresses": {"a@lists.example.com\nb@lists.example.com"}}, globalPrincipal); rec.Code != http.StatusSeeOther {
+		t.Fatalf("recipients = %d %s", rec.Code, rec.Body.String())
+	}
+	after, err := st.GetInboundDomain(d.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(before, after) {
+		t.Errorf("saving untouched changed the domain:\nbefore %+v\nafter  %+v", before, after)
+	}
+}
+
+// What the Spam filter box says follows the settings the panel read, and the
+// address of the filter is the global role's alone.
+func TestInboundDomainSpamFilterBox(t *testing.T) {
+	s := newInboundStand(t)
+	id := itoa(s.a.ID)
+	get := func(ownsA bool) string {
+		pr := &s.global
+		if ownsA {
+			pr = &s.ownsA
+		}
+		rec := send(s.h.HandleInboundDetail, pr, http.MethodGet, "/inbound/domains/"+id, map[string]string{"id": id}, nil)
+		if rec.Code != http.StatusOK {
+			t.Fatalf("detail = %d", rec.Code)
+		}
+		return rec.Body.String()
+	}
+
+	body := get(false)
+	has(t, "filter off", body, `turning the filter on is a server setting (<code>INBOUND_ANTISPAM_MILTER</code>)`)
+	lacks(t, "filter off", body, `Applies to`)
+	has(t, "filter off, domain administrator", get(true), `set by the server&#39;s administrator`)
+	lacks(t, "filter off, domain administrator", get(true), `INBOUND_ANTISPAM_MILTER`)
+
+	s.h.cfg.InboundAntispamMilter, s.h.cfg.InboundAntispamAction = "inet:antispam:11332", "tempfail"
+	body = get(false)
+	has(t, "filter on", body, `Every inbound domain of this server`, `inet:antispam:11332`, `Mail is deferred until it answers`)
+	body = get(true)
+	has(t, "filter on, domain administrator", body, `Every inbound domain of this server`, `Mail is deferred until it answers`)
+	lacks(t, "filter on, domain administrator", body, `inet:antispam`, `/delete`)
+
+	s.h.cfg.InboundAntispamAction = "accept"
+	has(t, "filter on, accept", get(false), `Mail is accepted unfiltered`)
+	s.h.cfg.InboundAntispamAction = ""
+	lacks(t, "filter on, action unknown", get(false), `If the filter is down`)
+
+	// The list says the same in its head.
+	list := send(s.h.HandleInboundList, &s.global, http.MethodGet, "/inbound/domains", nil, nil).Body.String()
+	has(t, "list", list, `Spam filter <span class="tag is-success is-light">on</span> · 2 domains`)
+	s.h.cfg.InboundAntispamMilter = ""
+	list = send(s.h.HandleInboundList, &s.global, http.MethodGet, "/inbound/domains", nil, nil).Body.String()
+	has(t, "list", list, `Spam filter <span class="tag is-light">off</span> · 2 domains`)
+}

internal/web/handlers/handlers_inbound_test.go

@@ -82,7 +82,7 @@ func TestInboundListAndAdd(t *testing.T) {
 	if rec.Code != http.StatusOK {
 		t.Fatalf("list = %d\n%s", rec.Code, rec.Body.String())
 	}
-	if !strings.Contains(rec.Body.String(), "Add inbound domain") {
+	if !strings.Contains(rec.Body.String(), "Add a domain") {
 		t.Fatal("list missing add form")
 	}
 
@@ -158,3 +158,72 @@ func TestInboundDelete(t *testing.T) {
 		t.Fatal("domain still present")
 	}
 }
+
+// The list and the confirmation are the kit pages: the handlers fill them from
+// what is stored, and a refused add comes back on the list with what was typed.
+func TestInboundListPageFromTheStore(t *testing.T) {
+	h, st := inboundHandlers(t)
+	d, err := st.AddInboundDomain("lists.example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := h.inbound.SetTransport(d.ID, "mx.internal", "2525", "encrypt"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := st.AddInboundDomain("bare.example.com"); err != nil {
+		t.Fatal(err)
+	}
+
+	body := inboundCall(h, http.MethodGet, "/inbound/domains", nil, globalPrincipal).Body.String()
+	has(t, "list", body, `<h1 class="title is-3">Inbound domains</h1>`, `<h2>Add a domain</h2>`, `action="/inbound/domains"`,
+		`<strong>lists.example.com</strong>`, `>mx.internal:2525<`, `required</span>`, `opportunistic</span>`, `>—<`,
+		`0 addresses`, `href="/inbound/domains/`+itoa(d.ID)+`/delete"`, `2 domains`, `>MX</span>`)
+
+	rec := inboundCall(h, http.MethodPost, "/inbound/domains", url.Values{"name": {"lists.example.com"}}, globalPrincipal)
+	if rec.Code != http.StatusConflict {
+		t.Fatalf("duplicate add = %d, want 409", rec.Code)
+	}
+	has(t, "refused add", rec.Body.String(), `<div class="notification is-danger is-light">`,
+		`That inbound domain is already configured.`, `value="lists.example.com"`)
+
+	rec = inboundCall(h, http.MethodPost, "/inbound/domains", url.Values{"name": {"not a domain"}}, globalPrincipal)
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("invalid add = %d, want 400", rec.Code)
+	}
+	has(t, "invalid add", rec.Body.String(), `notification is-danger`, `value="not a domain"`)
+
+	body = send(h.HandleInboundList, &globalPrincipal, http.MethodGet, "/inbound/domains?deleted=1", nil, nil).Body.String()
+	has(t, "after a delete", body, `notification is-success`, `Inbound domain deleted.`)
+}
+
+func TestInboundDeletePageNamesWhatGoesWithTheDomain(t *testing.T) {
+	h, st := inboundHandlers(t)
+	d, err := st.AddInboundDomain("lists.example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+	id := itoa(d.ID)
+
+	body := inboundCall(h, http.MethodGet, "/inbound/domains/"+id+"/delete", nil, globalPrincipal).Body.String()
+	has(t, "delete page", body, `<h1 class="title is-3">Delete lists.example.com</h1>`, `sp-danger-zone`,
+		`stop accepting mail for it on port 25`, `action="/inbound/domains/`+id+`/delete"`,
+		`href="/inbound/domains/`+id+`">Keep it</a>`)
+	lacks(t, "delete page of a domain with no upstream and no recipients", body, `upstream`, `recipient`)
+
+	if err := h.inbound.SetTransport(d.ID, "mx.internal", "25", "may"); err != nil {
+		t.Fatal(err)
+	}
+	if err := h.inbound.SetRecipients(d.ID, "list", []string{"a@lists.example.com", "b@lists.example.com"}); err != nil {
+		t.Fatal(err)
+	}
+	body = inboundCall(h, http.MethodGet, "/inbound/domains/"+id+"/delete", nil, globalPrincipal).Body.String()
+	has(t, "delete page", body, `remove its upstream and its 2 listed recipients.`)
+
+	// Recipients are only a list while the domain accepts listed addresses.
+	if err := h.inbound.SetRecipients(d.ID, "any", nil); err != nil {
+		t.Fatal(err)
+	}
+	body = inboundCall(h, http.MethodGet, "/inbound/domains/"+id+"/delete", nil, globalPrincipal).Body.String()
+	has(t, "delete page, any recipient", body, `remove its upstream.`)
+	lacks(t, "delete page, any recipient", body, `recipient`)
+}

internal/web/handlers/handlers_status.go

@@ -48,10 +48,9 @@ func (h *Handlers) HandleOverview(w http.ResponseWriter, r *http.Request) {
 			http.Error(w, "internal error", http.StatusInternalServerError)
 			return
 		}
-		for _, row := range h.inboundRows(list) {
+		for _, row := range h.inboundRows(list, false) {
 			page.InboundRows = append(page.InboundRows, view.OverviewInbound{
-				Name: row.Name, Href: fmt.Sprintf("/inbound/domains/%d", row.ID),
-				MX: view.Tag{Status: string(row.DNS), Label: "MX"}, Upstream: row.Upstream,
+				Name: row.Name, Href: row.Href, MX: row.DNS, Upstream: row.Upstream,
 			})
 		}
 	}