release: 0.1.0: Phases 0-11: panel, Postfix/DKIM, milter, backup, Docker image

Initial feature-complete implementation of the v1.0 specification (phases 0-11 of `docs/implementation-plan.md`).
Added:
  - Panel (Go, single static binary) with SQLite persistence, one-time
  - Domain management with per-domain DKIM (RSA-2048, generated in pure Go) and
  - Application (sender identity) management: SASL credentials via `sasldb2`,
  - Full Postfix relay config generated from env at container start: SMTPS 465,
  - Journal milter (pure Go, `go-milter`) recording every send to `send_log`;
  … (6 more in CHANGELOG)

Full detail: CHANGELOG.md (0.1.0).

internal/web/validate_test.go

@@ -0,0 +1,67 @@
+package web
+
+import "testing"
+
+func TestNormalizeDomain(t *testing.T) {
+	cases := map[string]string{
+		"  Example.COM ":   "example.com",
+		"MAIL.Example.Org": "mail.example.org",
+		"example.com":      "example.com",
+	}
+	for in, want := range cases {
+		if got := normalizeDomain(in); got != want {
+			t.Errorf("normalizeDomain(%q) = %q, want %q", in, got, want)
+		}
+	}
+}
+
+func TestValidateDomainValid(t *testing.T) {
+	valid := []string{
+		"example.com",
+		"mail.example.com",
+		"a.co",
+		"sub-domain.example.co.uk",
+		"x1.y2.z3",
+		"1example.com",
+	}
+	for _, d := range valid {
+		if err := validateDomain(d); err != nil {
+			t.Errorf("validateDomain(%q) unexpected error: %v", d, err)
+		}
+	}
+}
+
+func TestValidateDomainInvalid(t *testing.T) {
+	invalid := []string{
+		"",              // empty
+		"localhost",     // single label
+		"example",       // single label
+		".example.com",  // leading dot -> empty label
+		"example.com.",  // trailing dot -> empty label
+		"exa mple.com",  // space
+		"example..com",  // empty label
+		"-example.com",  // label starts with '-'
+		"example-.com",  // label ends with '-'
+		"example.com\n", // newline (config injection attempt)
+		"exa*mple.com",  // disallowed char
+		"exa_mple.com",  // underscore not allowed in domains
+		"Example.com",   // upper-case (must be normalised first)
+		"пример.рф",     // non-ASCII
+		"example.c/m",   // slash (path-traversal attempt)
+	}
+	for _, d := range invalid {
+		if err := validateDomain(d); err == nil {
+			t.Errorf("validateDomain(%q) = nil, want error", d)
+		}
+	}
+}
+
+func TestValidateDomainLongLabelRejected(t *testing.T) {
+	label := make([]byte, 64)
+	for i := range label {
+		label[i] = 'a'
+	}
+	if err := validateDomain(string(label) + ".com"); err == nil {
+		t.Error("expected error for over-long label")
+	}
+}