panel-redesign: three choices for a domain's report address; row actions

Follows the design and guard commits before it. Written by Sonnet,
reviewed by Opus.

The report address
  - Baseline: users.dmarc_default_mode, users.dmarc_default_address and
    domains.dmarc_rua_user_id are gone. domains.dmarc_rua alone says
    where reports go: '' is no reports (a new domain), the address
    SelfPost derives for the domain is the hosted choice (while hosted
    reports are on), anything else is a typed address.
  - Removed: the user default and its store functions, a domain
    following a user, keep / inherit, followCreator, POST /account/dmarc
    with its handler, the DMARC box of Account, the user-delete item
    about domains losing their address.
  - Domain settings offers the three choices; beside the typed address a
    "Use my e-mail" button fills in the profile e-mail (panel.js: one
    generic data-fill hook; absent without a profile e-mail; it fills,
    it does not save).
  - The DMARC record's note names the address and no user. This closes
    L4 of the security review.
  - Domain export / import carries the address as a plain string.
  - The ingest allow-list is the generic mailbox plus each domain's
    address on this host; the generic mailbox is always open now.
  - dev/migrate1x (not in the tree): a 1.x domain that inherited the
    instance default gets that address as its own, so no published rua=
    changes.

Row actions
  - row_action partial (RowAction: Label, Post, Confirm, Danger);
    panel.css has the mockup's three rules. A row of the Applications
    table is Edit, New password, Delete; the confirmation texts are the
    ones the application page's head uses. Both roles, with the checks
    of the application page.

Tests cover: a new domain has no reports; each choice saved and shown
selected; hosted refused when hosted reports are off; a bad address
refused with what was typed kept; an untouched save changes nothing in
each state; the fill button with and without a profile e-mail; deleting
a user leaves every domain's address; the row's forms, targets and
confirmations for both roles and a 404 for a stranger.

Known: if hosted reports are switched off later, a stored hosted address
reads as a typed one. docs/guide.md still describes the old choices -
the documentation step.

Evidence
  - docs/assets/panel-redesign/evidence/account.png,
    out-domain-settings.png, out-domain.png, user-delete.png, help.png:
    1440 px wide, headless Edge, real templates served locally with
    their fixtures - NOT from the container.
  - panel/audit.js on out-domain, out-domain-settings, account, help,
    components and user-delete at 1440 and 1280: 1420 texts checked,
    problems: [].
  - In a browser: the fill button sets the field and does not submit;
    the row buttons have the font, size and colour of the Edit link,
    Delete the red of the other delete links; data-confirm fires on
    both. Hover and focus states were not observed.
  - go test -count=1 ./internal/web/... ./internal/store/...
    ./internal/dmarc/... ./internal/app/... ./internal/inbound/...
    ./cmd/panel: ok (ten packages; dev/migrate1x also ok).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/store/domains.go

@@ -25,13 +25,13 @@ type Domain struct {
 	ID           int64
 	Name         string
 	DKIMSelector string
-	// Where DMARC aggregate reports go. With DMARCRuaUserID set the domain
-	// follows that user's default (DMARCDefault) and DMARCRua is ignored;
-	// otherwise DMARCRua is the address itself, "" meaning no reports.
-	DMARCRua       string
-	DMARCRuaUserID sql.NullInt64
-	CreatedAt      time.Time
-	AppCount       int
+	// Where DMARC aggregate reports go: the address itself, "" meaning no
+	// reports (which is what a new domain has). Whether it is the hosted
+	// address or one typed for the domain is told by its value; the store does
+	// not know the server's hostname.
+	DMARCRua  string
+	CreatedAt time.Time
+	AppCount  int
 }
 
 // AddDomain inserts a new sending domain. The caller is responsible for having
@@ -60,7 +60,7 @@ func (s *Store) AddDomain(name, selector string) (Domain, error) {
 // ordered by name.
 func (s *Store) ListDomains() ([]Domain, error) {
 	rows, err := s.db.Query(`
-		SELECT d.id, d.name, d.dkim_selector, d.dmarc_rua, d.dmarc_rua_user_id, d.created_at,
+		SELECT d.id, d.name, d.dkim_selector, d.dmarc_rua, d.created_at,
 		       (SELECT COUNT(*) FROM applications a WHERE a.domain_id = d.id)
 		FROM domains d
 		ORDER BY d.name`)
@@ -86,7 +86,7 @@ func (s *Store) ListDomains() ([]Domain, error) {
 // The filter is in the query, so a caller cannot forget it.
 func (s *Store) ListDomainsForUser(userID int64) ([]Domain, error) {
 	rows, err := s.db.Query(`
-		SELECT d.id, d.name, d.dkim_selector, d.dmarc_rua, d.dmarc_rua_user_id, d.created_at,
+		SELECT d.id, d.name, d.dkim_selector, d.dmarc_rua, d.created_at,
 		       (SELECT COUNT(*) FROM applications a WHERE a.domain_id = d.id)
 		FROM domains d
 		WHERE EXISTS (SELECT 1 FROM users u WHERE u.id = ? AND u.all_domains = 1)
@@ -112,7 +112,7 @@ func (s *Store) ListDomainsForUser(userID int64) ([]Domain, error) {
 // ErrDomainNotFound.
 func (s *Store) GetDomain(id int64) (Domain, error) {
 	row := s.db.QueryRow(`
-		SELECT d.id, d.name, d.dkim_selector, d.dmarc_rua, d.dmarc_rua_user_id, d.created_at,
+		SELECT d.id, d.name, d.dkim_selector, d.dmarc_rua, d.created_at,
 		       (SELECT COUNT(*) FROM applications a WHERE a.domain_id = d.id)
 		FROM domains d
 		WHERE d.id = ?`, id)
@@ -154,7 +154,7 @@ func scanDomain(r scanRow) (Domain, error) {
 		d         Domain
 		createdAt string
 	)
-	if err := r.Scan(&d.ID, &d.Name, &d.DKIMSelector, &d.DMARCRua, &d.DMARCRuaUserID, &createdAt, &d.AppCount); err != nil {
+	if err := r.Scan(&d.ID, &d.Name, &d.DKIMSelector, &d.DMARCRua, &createdAt, &d.AppCount); err != nil {
 		return Domain{}, err
 	}
 	d.CreatedAt, _ = time.Parse(time.RFC3339, createdAt)
@@ -172,21 +172,10 @@ func isUniqueViolation(err error) bool {
 	return false
 }
 
-// SetDomainDMARCAddress gives the domain a report address of its own; "" means
-// no aggregate reports. The domain stops following anyone's default.
+// SetDomainDMARCAddress sets where the domain's aggregate reports go; "" means
+// no reports.
 func (s *Store) SetDomainDMARCAddress(id int64, rua string) error {
-	return s.updateDomainDMARC(id, rua, sql.NullInt64{})
-}
-
-// SetDomainDMARCUser makes the domain follow userID's default report address
-// (DMARCDefault). If that user is later deleted the domain falls back to no
-// reports rather than to someone else's default.
-func (s *Store) SetDomainDMARCUser(id, userID int64) error {
-	return s.updateDomainDMARC(id, "", sql.NullInt64{Int64: userID, Valid: true})
-}
-
-func (s *Store) updateDomainDMARC(id int64, rua string, userID sql.NullInt64) error {
-	res, err := s.db.Exec("UPDATE domains SET dmarc_rua = ?, dmarc_rua_user_id = ? WHERE id = ?", rua, userID, id)
+	res, err := s.db.Exec("UPDATE domains SET dmarc_rua = ? WHERE id = ?", rua, id)
 	if err != nil {
 		return fmt.Errorf("update domain dmarc rua: %w", err)
 	}
@@ -200,24 +189,6 @@ func (s *Store) updateDomainDMARC(id int64, rua string, userID sql.NullInt64) er
 	return nil
 }
 
-// DomainDMARCRua resolves where the domain's aggregate reports go: its own
-// address, or the default of the user it follows. hosted is the SelfPost-hosted
-// mailbox for this domain, "" when report ingest is off (the store does not
-// know the server's hostname). The result is "" for a policy-only record.
-func (s *Store) DomainDMARCRua(d Domain, hosted string) (string, error) {
-	if !d.DMARCRuaUserID.Valid {
-		return d.DMARCRua, nil
-	}
-	def, err := s.GetDMARCDefault(d.DMARCRuaUserID.Int64)
-	if errors.Is(err, ErrUserNotFound) {
-		return "", nil
-	}
-	if err != nil {
-		return "", err
-	}
-	return def.Resolve(hosted), nil
-}
-
 // DomainExists reports whether a sending domain with this name is configured.
 // Used by the DMARC ingest path to refuse reports for domains this relay does
 // not send for (security.md: report XML is attacker-supplied input).

internal/store/domains_dmarc_test.go

@@ -5,11 +5,9 @@ import (
 	"testing"
 )
 
-const hostedForTest = "dmarc+example.com@mail.example.org"
-
-// A domain either has a report address of its own or follows a user's default;
-// the two never mix, and a fresh domain has neither.
-func TestDomainDMARCAddressAndUser(t *testing.T) {
+// A domain has one report address and nothing else: a fresh domain has none,
+// the address is whatever was set last, and "" is no reports.
+func TestDomainDMARCAddress(t *testing.T) {
 	st := openTestStore(t)
 	d, err := st.AddDomain("example.com", "sel")
 	if err != nil {
@@ -19,123 +17,50 @@ func TestDomainDMARCAddressAndUser(t *testing.T) {
 	if err != nil {
 		t.Fatalf("GetDomain: %v", err)
 	}
-	if got.DMARCRua != "" || got.DMARCRuaUserID.Valid {
-		t.Fatalf("a new domain = %q / follows %v, want no reports", got.DMARCRua, got.DMARCRuaUserID)
+	if got.DMARCRua != "" {
+		t.Fatalf("a new domain reports to %q, want no reports", got.DMARCRua)
 	}
 
-	if err := st.SetDomainDMARCAddress(d.ID, "reports@hub.com"); err != nil {
-		t.Fatalf("SetDomainDMARCAddress: %v", err)
-	}
-	got, _ = st.GetDomain(d.ID)
-	if rua, err := st.DomainDMARCRua(got, hostedForTest); err != nil || rua != "reports@hub.com" {
-		t.Fatalf("own address resolves to %q, %v", rua, err)
-	}
-
-	if err := st.CreateGlobalUser("admin", "hash"); err != nil {
-		t.Fatalf("CreateGlobalUser: %v", err)
-	}
-	u, _ := st.GetUserByUsername("admin")
-	if err := st.SetDomainDMARCUser(d.ID, u.ID); err != nil {
-		t.Fatalf("SetDomainDMARCUser: %v", err)
-	}
-	got, _ = st.GetDomain(d.ID)
-	if got.DMARCRua != "" || !got.DMARCRuaUserID.Valid || got.DMARCRuaUserID.Int64 != u.ID {
-		t.Fatalf("following a user left %q / %v; the own address must be dropped", got.DMARCRua, got.DMARCRuaUserID)
-	}
-
-	if err := st.SetDomainDMARCAddress(d.ID, ""); err != nil {
-		t.Fatalf("SetDomainDMARCAddress none: %v", err)
-	}
-	got, _ = st.GetDomain(d.ID)
-	if got.DMARCRua != "" || got.DMARCRuaUserID.Valid {
-		t.Fatalf("none = %q / %v", got.DMARCRua, got.DMARCRuaUserID)
+	for _, rua := range []string{"reports@hub.com", "dmarc+example.com@mail.example.org", ""} {
+		if err := st.SetDomainDMARCAddress(d.ID, rua); err != nil {
+			t.Fatalf("SetDomainDMARCAddress(%q): %v", rua, err)
+		}
+		if got, _ = st.GetDomain(d.ID); got.DMARCRua != rua {
+			t.Fatalf("set %q, read %q", rua, got.DMARCRua)
+		}
 	}
 
 	if err := st.SetDomainDMARCAddress(d.ID+100, "x@y.com"); !errors.Is(err, ErrDomainNotFound) {
-		t.Fatalf("unknown domain = %v, want ErrDomainNotFound", err)
+		t.Errorf("unknown domain = %v, want ErrDomainNotFound", err)
 	}
 }
 
-// A domain that follows a user resolves to whatever that user's default says
-// today — every mode — and changes with it.
-func TestDomainFollowsUserDefault(t *testing.T) {
+// Deleting a user changes no domain's report address: the address belongs to
+// the domain, not to whoever set it.
+func TestDeletingAUserLeavesEveryDomainAddressAlone(t *testing.T) {
 	st := openTestStore(t)
 	if err := st.CreateGlobalUser("admin", "hash"); err != nil {
 		t.Fatalf("CreateGlobalUser: %v", err)
 	}
-	u, _ := st.GetUserByUsername("admin")
-	if err := st.UpdateUser(u.ID, "admin", "hash", "mix@example.org"); err != nil {
-		t.Fatalf("UpdateUser: %v", err)
-	}
-	d, _ := st.AddDomain("example.com", "sel")
-	if err := st.SetDomainDMARCUser(d.ID, u.ID); err != nil {
-		t.Fatalf("SetDomainDMARCUser: %v", err)
-	}
-	d, _ = st.GetDomain(d.ID)
-
-	for _, tc := range []struct {
-		mode, address string
-		hosted        string
-		want          string
-	}{
-		{DMARCDefaultNone, "", hostedForTest, ""},
-		{DMARCDefaultAccount, "", hostedForTest, "mix@example.org"},
-		{DMARCDefaultCustom, "dmarc@hub.example", hostedForTest, "dmarc@hub.example"},
-		{DMARCDefaultHosted, "", hostedForTest, hostedForTest},
-		// Ingest switched off: a hosted default has no mailbox to point at.
-		{DMARCDefaultHosted, "", "", ""},
-		// The custom address belongs to the custom mode only.
-		{DMARCDefaultAccount, "ignored@hub.example", hostedForTest, "mix@example.org"},
-	} {
-		if err := st.SetDMARCDefault(u.ID, tc.mode, tc.address); err != nil {
-			t.Fatalf("SetDMARCDefault(%s): %v", tc.mode, err)
-		}
-		got, err := st.DomainDMARCRua(d, tc.hosted)
-		if err != nil || got != tc.want {
-			t.Errorf("mode %s, hosted %q: resolved %q, %v; want %q", tc.mode, tc.hosted, got, err, tc.want)
-		}
-	}
-	def, err := st.GetDMARCDefault(u.ID)
-	if err != nil || def.Address != "" || def.Username != "admin" {
-		t.Errorf("default after a non-custom mode = %+v, %v; the custom address must be cleared", def, err)
-	}
-	if err := st.SetDMARCDefault(u.ID, "profile", ""); err == nil {
-		t.Error("an unknown mode was stored")
-	}
-	if err := st.SetDMARCDefault(u.ID+100, DMARCDefaultNone, ""); !errors.Is(err, ErrUserNotFound) {
-		t.Errorf("unknown user = %v, want ErrUserNotFound", err)
-	}
-}
-
-// Deleting the user a domain follows must leave the domain with no report
-// address — not with another user's default, and not with a dangling id.
-func TestDeletingTheFollowedUserLeavesNoReports(t *testing.T) {
-	st := openTestStore(t)
-	if err := st.CreateGlobalUser("admin", "hash"); err != nil {
-		t.Fatalf("CreateGlobalUser: %v", err)
-	}
-	d, _ := st.AddDomain("example.com", "sel")
 	id, err := st.CreateUser("second", "hash", RoleGlobal, Reach{})
 	if err != nil {
 		t.Fatalf("CreateUser: %v", err)
 	}
-	if err := st.SetDMARCDefault(id, DMARCDefaultCustom, "dmarc@hub.example"); err != nil {
-		t.Fatalf("SetDMARCDefault: %v", err)
+	if err := st.UpdateUser(id, "second", "hash", "second@hub.example"); err != nil {
+		t.Fatalf("UpdateUser: %v", err)
 	}
-	if err := st.SetDomainDMARCUser(d.ID, id); err != nil {
-		t.Fatalf("SetDomainDMARCUser: %v", err)
+	typed, _ := st.AddDomain("typed.example", "sel")
+	none, _ := st.AddDomain("none.example", "sel")
+	if err := st.SetDomainDMARCAddress(typed.ID, "second@hub.example"); err != nil {
+		t.Fatalf("SetDomainDMARCAddress: %v", err)
 	}
 	if err := st.DeleteUser(id); err != nil {
 		t.Fatalf("DeleteUser: %v", err)
 	}
-	got, err := st.GetDomain(d.ID)
-	if err != nil {
-		t.Fatalf("GetDomain: %v", err)
+	if got, _ := st.GetDomain(typed.ID); got.DMARCRua != "second@hub.example" {
+		t.Errorf("typed address after deleting the user = %q", got.DMARCRua)
 	}
-	if got.DMARCRuaUserID.Valid || got.DMARCRua != "" {
-		t.Fatalf("after deleting the followed user: %q / %v, want no reports", got.DMARCRua, got.DMARCRuaUserID)
-	}
-	if rua, err := st.DomainDMARCRua(got, hostedForTest); err != nil || rua != "" {
-		t.Fatalf("resolved %q, %v; want no reports", rua, err)
+	if got, _ := st.GetDomain(none.ID); got.DMARCRua != "" {
+		t.Errorf("no-reports domain after deleting the user = %q", got.DMARCRua)
 	}
 }

internal/store/migrations/0001_init.sql

@@ -24,27 +24,21 @@ CREATE TABLE settings (
 -- exists. role is a reach, not a rank: 'global' sees the whole instance,
 -- 'domain' only what is assigned below.
 --
--- email is the user's own address — what the panel writes to. The DMARC
--- default is a separate choice that may use it: dmarc_default_mode says where
--- aggregate reports go for a domain that follows this user
--- (domains.dmarc_rua_user_id): 'hosted' (SelfPost's own mailbox for that
--- domain), 'account' (email above), 'custom' (dmarc_default_address) or 'none'.
+-- email is the user's own address — what the panel writes to, and what the
+-- button beside a domain's typed report address fills it with.
 --
 -- all_domains / all_inbound_domains widen a 'domain' user's list to every
 -- domain of that direction, including the ones added later; with a flag set
 -- the rows of the matching assignment table are ignored.
 CREATE TABLE users (
-    id                    INTEGER PRIMARY KEY AUTOINCREMENT,
-    username              TEXT NOT NULL UNIQUE,
-    password_hash         TEXT NOT NULL,
-    role                  TEXT NOT NULL CHECK (role IN ('global', 'domain')),
-    email                 TEXT NOT NULL DEFAULT '',
-    dmarc_default_mode    TEXT NOT NULL DEFAULT 'none'
-                          CHECK (dmarc_default_mode IN ('hosted', 'account', 'custom', 'none')),
-    dmarc_default_address TEXT NOT NULL DEFAULT '',
-    all_domains           INTEGER NOT NULL DEFAULT 0 CHECK (all_domains IN (0, 1)),
-    all_inbound_domains   INTEGER NOT NULL DEFAULT 0 CHECK (all_inbound_domains IN (0, 1)),
-    created_at            TEXT NOT NULL
+    id                  INTEGER PRIMARY KEY AUTOINCREMENT,
+    username            TEXT NOT NULL UNIQUE,
+    password_hash       TEXT NOT NULL,
+    role                TEXT NOT NULL CHECK (role IN ('global', 'domain')),
+    email               TEXT NOT NULL DEFAULT '',
+    all_domains         INTEGER NOT NULL DEFAULT 0 CHECK (all_domains IN (0, 1)),
+    all_inbound_domains INTEGER NOT NULL DEFAULT 0 CHECK (all_inbound_domains IN (0, 1)),
+    created_at          TEXT NOT NULL
 );
 
 -- Panel login sessions. Persisted so a login survives a container restart or
@@ -65,18 +59,17 @@ CREATE INDEX idx_sessions_expires_at ON sessions (expires_at);
 -- Sending (outbound) domains. DKIM keys themselves live on disk under /data;
 -- this row records the selector and metadata.
 --
--- Where the domain's DMARC aggregate reports go (rua=): with dmarc_rua_user_id
--- set, the domain follows that user's default and dmarc_rua is ignored;
--- otherwise dmarc_rua is the address itself, '' meaning no reports. Deleting
--- the user leaves the domain at "none" rather than silently handing its
--- reports to someone else.
+-- Where the domain's DMARC aggregate reports go (rua=): dmarc_rua is the
+-- address itself, '' meaning no reports — which is what a new domain has. The
+-- three choices (no reports, SelfPost hosted, an address typed for the domain)
+-- are told apart by the value: the hosted one is the address SelfPost derives
+-- for the domain and the server's hostname. No user is involved.
 CREATE TABLE domains (
-    id                INTEGER PRIMARY KEY AUTOINCREMENT,
-    name              TEXT NOT NULL UNIQUE,
-    dkim_selector     TEXT NOT NULL,
-    dmarc_rua         TEXT NOT NULL DEFAULT '',
-    dmarc_rua_user_id INTEGER REFERENCES users(id) ON DELETE SET NULL,
-    created_at        TEXT NOT NULL
+    id            INTEGER PRIMARY KEY AUTOINCREMENT,
+    name          TEXT NOT NULL UNIQUE,
+    dkim_selector TEXT NOT NULL,
+    dmarc_rua     TEXT NOT NULL DEFAULT '',
+    created_at    TEXT NOT NULL
 );
 
 -- Outbound domains assigned to a 'domain' user.

internal/store/schema_test.go

@@ -40,9 +40,9 @@ func TestBaselineSchema(t *testing.T) {
 	st := openTestStore(t)
 	want := map[string]string{
 		"settings":              "key value",
-		"users":                 "id username password_hash role email dmarc_default_mode dmarc_default_address all_domains all_inbound_domains created_at",
+		"users":                 "id username password_hash role email all_domains all_inbound_domains created_at",
 		"sessions":              "token_hash user_id created_at expires_at",
-		"domains":               "id name dkim_selector dmarc_rua dmarc_rua_user_id created_at",
+		"domains":               "id name dkim_selector dmarc_rua created_at",
 		"user_domains":          "user_id domain_id",
 		"applications":          "id domain_id login address_mode auth_ip_restrict auth_allowed_ips created_at",
 		"application_addresses": "id application_id address",
@@ -223,33 +223,30 @@ func TestOpenRefusesANewerSchema(t *testing.T) {
 // table does when either side goes away.
 func TestBaselineConstraints(t *testing.T) {
 	st := openTestStore(t)
-	insert := func(role, mode string, all int) error {
+	insert := func(name, role string, all int) error {
 		_, err := st.db.Exec(
-			"INSERT INTO users (username, password_hash, role, dmarc_default_mode, all_domains, created_at) VALUES (?, 'h', ?, ?, ?, 'now')",
-			role+mode, role, mode, all)
+			"INSERT INTO users (username, password_hash, role, all_domains, created_at) VALUES (?, 'h', ?, ?, 'now')",
+			name, role, all)
 		return err
 	}
-	if err := insert("global", "none", 0); err != nil {
+	if err := insert("plain", "global", 0); err != nil {
 		t.Fatalf("a plain global user: %v", err)
 	}
-	if err := insert("domain", "hosted", 1); err != nil {
+	if err := insert("everything", "domain", 1); err != nil {
 		t.Fatalf("a domain user with All: %v", err)
 	}
-	if err := insert("domain_admin", "none", 0); err == nil {
+	if err := insert("old-role", "domain_admin", 0); err == nil {
 		t.Error("the 1.x role name domain_admin was accepted")
 	}
-	if err := insert("global", "profile", 0); err == nil {
-		t.Error("an unknown dmarc_default_mode was accepted")
-	}
-	if err := insert("domain", "custom", 2); err == nil {
+	if err := insert("two", "domain", 2); err == nil {
 		t.Error("all_domains = 2 was accepted")
 	}
 
-	u, err := st.GetUserByUsername("domainhosted")
+	u, err := st.GetUserByUsername("everything")
 	if err != nil {
 		t.Fatalf("GetUserByUsername: %v", err)
 	}
-	if !u.AllDomains || u.AllInboundDomains || u.DMARCDefaultMode != DMARCDefaultHosted {
+	if !u.AllDomains || u.AllInboundDomains {
 		t.Errorf("flags read back as %+v", u)
 	}
 

internal/store/users.go

@@ -29,59 +29,15 @@ const (
 	RoleDomain Role = "domain"
 )
 
-// How a user's default DMARC report address is chosen (users.dmarc_default_mode).
-const (
-	DMARCDefaultHosted  = "hosted"  // SelfPost's own mailbox for the domain
-	DMARCDefaultAccount = "account" // the user's account e-mail
-	DMARCDefaultCustom  = "custom"  // DMARCDefault.Address
-	DMARCDefaultNone    = "none"    // no aggregate reports
-)
-
-// DMARCDefault is a user's default report address: the choice a domain takes
-// over when it follows that user (Domain.DMARCRuaUserID).
-type DMARCDefault struct {
-	UserID   int64
-	Username string
-	Mode     string
-	Address  string // for DMARCDefaultCustom
-	Email    string // the account e-mail, for DMARCDefaultAccount
-}
-
-// Resolve returns the address the default stands for on one domain. hosted is
-// the SelfPost-hosted mailbox for that domain, "" when report ingest is off —
-// a hosted default then resolves to no reports.
-func (d DMARCDefault) Resolve(hosted string) string {
-	switch d.Mode {
-	case DMARCDefaultHosted:
-		return hosted
-	case DMARCDefaultAccount:
-		return d.Email
-	case DMARCDefaultCustom:
-		return d.Address
-	}
-	return ""
-}
-
-// ValidDMARCDefaultMode reports whether mode is one of the stored choices.
-func ValidDMARCDefaultMode(mode string) bool {
-	switch mode {
-	case DMARCDefaultHosted, DMARCDefaultAccount, DMARCDefaultCustom, DMARCDefaultNone:
-		return true
-	}
-	return false
-}
-
 // User is a panel login (not an application SASL account).
 type User struct {
 	ID           int64
 	Username     string
 	PasswordHash string
 	Role         Role
-	// Email is the user's own address — what the panel writes to. DMARC may
-	// use it (DMARCDefaultAccount) but it is not a DMARC field.
-	Email               string
-	DMARCDefaultMode    string
-	DMARCDefaultAddress string
+	// Email is the user's own address — what the panel writes to, and what the
+	// button beside a domain's typed report address fills it with.
+	Email string
 	// AllDomains / AllInboundDomains widen a domain user's list to every
 	// domain of that direction, including those added later; the id lists
 	// are then ignored.
@@ -92,19 +48,14 @@ type User struct {
 	InboundDomainIDs  []int64
 }
 
-// DMARCDefault returns the user's default report address choice.
-func (u User) DMARCDefault() DMARCDefault {
-	return DMARCDefault{UserID: u.ID, Username: u.Username, Mode: u.DMARCDefaultMode, Address: u.DMARCDefaultAddress, Email: u.Email}
-}
-
-const userColumns = "id, username, password_hash, role, email, dmarc_default_mode, dmarc_default_address, all_domains, all_inbound_domains, created_at"
+const userColumns = "id, username, password_hash, role, email, all_domains, all_inbound_domains, created_at"
 
 func scanUser(r scanRow) (User, error) {
 	var (
 		u         User
 		createdAt string
 	)
-	err := r.Scan(&u.ID, &u.Username, &u.PasswordHash, &u.Role, &u.Email, &u.DMARCDefaultMode, &u.DMARCDefaultAddress,
+	err := r.Scan(&u.ID, &u.Username, &u.PasswordHash, &u.Role, &u.Email,
 		&u.AllDomains, &u.AllInboundDomains, &createdAt)
 	if err != nil {
 		return User{}, err
@@ -318,47 +269,6 @@ func (s *Store) UpdateUser(id int64, username, passwordHash, email string) error
 	return nil
 }
 
-// SetDMARCDefault stores the user's default report address choice. address is
-// kept only for DMARCDefaultCustom. Every domain that follows this user
-// resolves to the new choice from the next read on.
-func (s *Store) SetDMARCDefault(userID int64, mode, address string) error {
-	if !ValidDMARCDefaultMode(mode) {
-		return fmt.Errorf("set dmarc default: unknown mode %q", mode)
-	}
-	if mode != DMARCDefaultCustom {
-		address = ""
-	}
-	res, err := s.db.Exec(
-		"UPDATE users SET dmarc_default_mode = ?, dmarc_default_address = ? WHERE id = ?", mode, address, userID)
-	if err != nil {
-		return fmt.Errorf("set dmarc default: %w", err)
-	}
-	n, err := res.RowsAffected()
-	if err != nil {
-		return fmt.Errorf("set dmarc default: %w", err)
-	}
-	if n == 0 {
-		return ErrUserNotFound
-	}
-	return nil
-}
-
-// GetDMARCDefault returns a user's default report address choice, or
-// ErrUserNotFound.
-func (s *Store) GetDMARCDefault(userID int64) (DMARCDefault, error) {
-	d := DMARCDefault{UserID: userID}
-	err := s.db.QueryRow(
-		"SELECT username, dmarc_default_mode, dmarc_default_address, email FROM users WHERE id = ?", userID,
-	).Scan(&d.Username, &d.Mode, &d.Address, &d.Email)
-	if errors.Is(err, sql.ErrNoRows) {
-		return DMARCDefault{}, ErrUserNotFound
-	}
-	if err != nil {
-		return DMARCDefault{}, fmt.Errorf("get dmarc default: %w", err)
-	}
-	return d, nil
-}
-
 // SetUserRole updates a user's role.
 func (s *Store) SetUserRole(userID int64, role Role) error {
 	res, err := s.db.Exec("UPDATE users SET role = ? WHERE id = ?", role, userID)

internal/store/users_test.go

@@ -26,11 +26,8 @@ func TestUpdateUser(t *testing.T) {
 	if got.Email != "reports@hub.example" {
 		t.Fatalf("email = %q", got.Email)
 	}
-	// The account e-mail is the user's own: saving it does not make it anyone's
-	// report address, and nothing is mirrored into the instance settings.
-	if got.DMARCDefaultMode != DMARCDefaultNone {
-		t.Fatalf("dmarc default mode = %q after setting the e-mail, want %q", got.DMARCDefaultMode, DMARCDefaultNone)
-	}
+	// The account e-mail is the user's own: nothing is mirrored into the
+	// instance settings.
 	if v, err := st.GetSetting("dmarc_report_email"); err == nil && v != "" {
 		t.Fatalf("the e-mail leaked into the instance settings: %q", v)
 	}