user-reauth: the user form asks for your account password (audit A2)

Security audit 2026-10-17, finding A2 (high), stage 0; the mockup is
2c27275. A stolen global session could set its own password on the user
form - no current password asked, the session kept - and then pass the
backup's reauth with it, or add a second global user with a known
password. Now the user form calls reauth (the backup's check: bcrypt
against the signed-in user's own hash, under auth.AllowPasswordChange) when
it adds a user and when a save sets a password, changes the e-mail (reset
links go there) or changes the role, the own account included; deleting a
user asks too, refused on its own confirmation page (renderUserDelete, a
Flash on UserDelete). Name and reach alone are not asked. Missing or wrong:
401 on the same page, "Your account password is incorrect.", nothing saved.

Tests: TestUserFormAsksForTheAccountPassword (create, each of password,
e-mail, role, own password, reach alone, delete); the user-form tests send
the field (withAccountPassword gives root a real hash and h an auth
module). go vet, go test ./internal/web/... on Windows.

Docs: security.md § Backup and domain export, guide § Users, help word for
word with the mockup; CHANGELOG [Unreleased] Security; plan line ticked.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/guide.md

@@ -719,6 +719,12 @@ The panel refuses to remove or demote the **last** global user, so it can never
 end up with none. A user cannot delete the account they are signed in with.
 The user form also sets the user's e-mail, which the users list shows.
 
+Adding a user, setting a user's password, changing their e-mail or role -
+your own account's included - and deleting a user ask for **your account
+password**, the one you sign in with, as a backup does and under the same
+limit on wrong guesses: a session left open is not enough to hand out an
+account. Saving only the name or the domain assignments is not asked.
+
 ### Sessions
 
 A login survives a container restart: sessions live in SQLite, not in

docs/security-audit-2026-10-17.md

@@ -685,12 +685,14 @@ the argument.
 
 ### Stage 0 — the high and the cheap guards (~5 h) → patch release
 
-- [ ] **A2.** `reauth` on user create, on a user update that carries
+- [x] **A2.** `reauth` on user create, on a user update that carries
   `password` or changes `role`, and on user delete; the user form gets the
   `account_password` field the Backup page has; security.md § Backup and
   domain export says the user form is covered. Done when a test with a
   session and no password gets 401 on all three and the existing user-form
-  tests pass with the field. — **Opus**, 2 h.
+  tests pass with the field. — **Opus**, 2 h. *Done 2026-10-17:* also on a
+  change of e-mail (where reset links go); a save of the name and the
+  reach alone is not asked; TestUserFormAsksForTheAccountPassword.
 - [ ] **I2.** The three DMARC maps in `drop_links`; `[ -L ]` beside `[ -e ]`
   in postfix-config.sh:538,545; an e2e case plants a link and expects the
   log line. — **Opus**, 0.5 h.

docs/security.md

@@ -471,6 +471,16 @@ operator can act on it.
   file's own protection, not this one: whoever downloads it chooses that
   password. The import and the `selfpost-backup` CLI, which runs inside the
   container, are not asked.
+- **Nor is it enough to make an account that would pass that check**
+  (security audit 2026-10-17, A2). Until `2.14.4` a `global` session could
+  set its own password on the user form - no current password asked, the
+  session kept - and then pass the check above with the password it chose,
+  or add a second global user with a password it knew. The user form now
+  asks for the same account password, under the same limiter, when it adds a
+  user and when a save sets a password, changes the e-mail (where reset
+  links go) or changes the role - the signed-in user's own account included -
+  and deleting a user asks for it too. A save of the name and the domain
+  assignments alone is not asked: neither reaches an account's secret.
 - Both files are secrets: a full backup carries DKIM keys, `sasldb2`, the
   panel users' password hashes, `docker-compose.yml`, `.env`, and the TLS
   private key from `certs/` when present; a domain export carries the DKIM key