panel-redesign: security review of 2.0 - sessions belong to a user by id

Stage 3, step 2. Reviewed by Fable (read-only), fixed by Sonnet with a
failing test before each fix, checked by Opus. No Critical or High
finding: route authorization, tenant isolation by id, the /server/
subtree guard, output encoding and the origin check were found sound.

Fixed
  - M1: a session was keyed by user name and had no link to the user. A
    deleted or renamed user's cookie stayed alive (renewed on every hit,
    before the user was looked up) and became a session of whoever was
    later created under that name, with that account's role. The
    baseline now has sessions.user_id REFERENCES users(id) ON DELETE
    CASCADE; the principal is resolved by id and a session is renewed
    only after its user was found. RenameSession is gone.
  - M2: any user's password change deleted every other user's sessions.
    It ends that user's other sessions only.
  - L1: a password set on the user form ends that user's sessions (an
    administrator editing their own account keeps the current one).
  - L2: store, saslpasswd2 and Postfix reload errors were shown verbatim
    on the application form, the inbound upstream / recipients forms and
    the limit recalculation - pages a domain administrator reaches.
    Validation errors (app.ValidationError, inbound.ValidationError,
    store.ErrNotAutoRateLimit) keep their text; anything else is logged
    and shown as "Could not save ... Check the logs and try again."
  - L3: store.ListDMARCReports treated an empty domain list as "all". It
    takes a scope now (AllDomains or a list; an empty list is no rows),
    and the DMARC hub is open to the domain role as the plan says: the
    reports of the assigned domains, without the instance-wide ingest
    box. The menu entry was already shown to them and led to a 404.
  - I1: /static/ answered with a listing of the embedded assets. A path
    that is not a known asset is a 404.

Consequences
  - The global DMARC hub lists reports of domains that were deleted
    since, too.
  - dev/migrate1x (not in the tree) no longer carries sessions over:
    everyone signs in again after the transfer.
  - docs/schema-migrations.md: the sessions row.

Recorded, not changed - for the owner:
  - L4: the report-address select names the followed user and their
    address to every administrator of the domain, by default the global
    administrator's login name. The plan asks for it.
  - L5: a delegated inbound upstream may be any host and port, loopback
    and private ranges included - within the trusted-operator model; to
    be listed among the accepted risks in security.md.
  - L6: Account's profile is saved without the password; becomes a
    requirement once password-reset mails to users.email.
  - Still echoing an error's text: backup and domain import (global
    only), the domain form's validation messages.

Not checked by the review: anything needing the container (e2e, real
Postfix / DNS), CSP behaviour in a live browser.

  go test -count=1 ./internal/web/... ./internal/store/... ./internal/app/...
    ./internal/inbound/... ./internal/dmarc/... ./cmd/panel
      ok  (all eleven packages; dev/migrate1x also ok)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/inbound/service.go

@@ -5,7 +5,6 @@
 package inbound
 
 import (
-	"fmt"
 	"strings"
 
 	"github.com/mixeme/selfpost/internal/postfix"
@@ -150,7 +149,7 @@ func parseRecipientAddresses(raw []string, domain string) ([]string, error) {
 		out = append(out, addr)
 	}
 	if len(out) == 0 {
-		return nil, fmt.Errorf("listed-recipients mode requires at least one address")
+		return nil, invalid("listed-recipients mode requires at least one address")
 	}
 	return out, nil
 }

internal/inbound/validate.go

@@ -7,6 +7,18 @@ import (
 	"strings"
 )
 
+// ValidationError is a refusal of what was submitted: its text says what the
+// administrator must fix and is written to be shown on the page. Any other
+// error from this package (a failed write, a failed reload) is not, and the
+// caller must not put its text in front of a user.
+type ValidationError struct{ msg string }
+
+func (e *ValidationError) Error() string { return e.msg }
+
+func invalid(format string, args ...any) error {
+	return &ValidationError{msg: fmt.Sprintf(format, args...)}
+}
+
 func normalizeDomain(name string) string {
 	return strings.ToLower(strings.TrimSpace(name))
 }
@@ -21,14 +33,14 @@ func normalizeHost(host string) string {
 
 func checkDomain(name string) error {
 	if name == "" {
-		return fmt.Errorf("domain is required")
+		return invalid("domain is required")
 	}
 	if len(name) > 253 {
-		return fmt.Errorf("domain must be at most 253 characters")
+		return invalid("domain must be at most 253 characters")
 	}
 	labels := strings.Split(name, ".")
 	if len(labels) < 2 {
-		return fmt.Errorf("domain must include at least one dot (e.g. example.com)")
+		return invalid("domain must include at least one dot (e.g. example.com)")
 	}
 	for _, label := range labels {
 		if err := checkLabel(label); err != nil {
@@ -40,10 +52,10 @@ func checkDomain(name string) error {
 
 func checkHost(host string) error {
 	if host == "" {
-		return fmt.Errorf("host is required")
+		return invalid("host is required")
 	}
 	if len(host) > 253 {
-		return fmt.Errorf("host must be at most 253 characters")
+		return invalid("host must be at most 253 characters")
 	}
 	if ip := net.ParseIP(host); ip != nil {
 		return nil
@@ -58,20 +70,20 @@ func checkHost(host string) error {
 
 func checkLabel(label string) error {
 	if len(label) == 0 {
-		return fmt.Errorf("must not contain an empty label")
+		return invalid("must not contain an empty label")
 	}
 	if len(label) > 63 {
-		return fmt.Errorf("each label must be at most 63 characters")
+		return invalid("each label must be at most 63 characters")
 	}
 	if label[0] == '-' || label[len(label)-1] == '-' {
-		return fmt.Errorf("labels must not start or end with '-'")
+		return invalid("labels must not start or end with '-'")
 	}
 	for i := 0; i < len(label); i++ {
 		c := label[i]
 		lower := c >= 'a' && c <= 'z'
 		digit := c >= '0' && c <= '9'
 		if !lower && !digit && c != '-' {
-			return fmt.Errorf("may contain only lower-case letters, digits, '.' and '-'")
+			return invalid("may contain only lower-case letters, digits, '.' and '-'")
 		}
 	}
 	return nil
@@ -80,11 +92,11 @@ func checkLabel(label string) error {
 func parsePort(raw string) (int, error) {
 	raw = strings.TrimSpace(raw)
 	if raw == "" {
-		return 0, fmt.Errorf("port is required")
+		return 0, invalid("port is required")
 	}
 	n, err := strconv.Atoi(raw)
 	if err != nil || n < 1 || n > 65535 {
-		return 0, fmt.Errorf("port must be between 1 and 65535")
+		return 0, invalid("port must be between 1 and 65535")
 	}
 	return n, nil
 }
@@ -94,7 +106,7 @@ func checkTLSMode(mode string) error {
 	case "may", "encrypt", "none":
 		return nil
 	default:
-		return fmt.Errorf("invalid TLS mode")
+		return invalid("invalid TLS mode")
 	}
 }
 
@@ -103,28 +115,28 @@ func checkRecipientMode(mode string) error {
 	case "list", "any":
 		return nil
 	default:
-		return fmt.Errorf("invalid recipient mode")
+		return invalid("invalid recipient mode")
 	}
 }
 
 func checkMailbox(addr, domain string) error {
 	at := strings.LastIndexByte(addr, '@')
 	if at <= 0 || at >= len(addr)-1 {
-		return fmt.Errorf("%q is not a valid email address", addr)
+		return invalid("%q is not a valid email address", addr)
 	}
 	local, host := addr[:at], addr[at+1:]
 	if host != domain {
-		return fmt.Errorf("%q does not belong to domain %s", addr, domain)
+		return invalid("%q does not belong to domain %s", addr, domain)
 	}
 	if local == "" || local[0] == '.' || local[len(local)-1] == '.' {
-		return fmt.Errorf("%q: invalid local part", addr)
+		return invalid("%q: invalid local part", addr)
 	}
 	for i := 0; i < len(local); i++ {
 		c := local[i]
 		lower := c >= 'a' && c <= 'z'
 		digit := c >= '0' && c <= '9'
 		if !lower && !digit && c != '.' && c != '-' && c != '_' && c != '+' {
-			return fmt.Errorf("%q: local part contains invalid characters", addr)
+			return invalid("%q: local part contains invalid characters", addr)
 		}
 	}
 	return nil