panel-redesign: security review of 2.0 - sessions belong to a user by id

Stage 3, step 2. Reviewed by Fable (read-only), fixed by Sonnet with a
failing test before each fix, checked by Opus. No Critical or High
finding: route authorization, tenant isolation by id, the /server/
subtree guard, output encoding and the origin check were found sound.

Fixed
  - M1: a session was keyed by user name and had no link to the user. A
    deleted or renamed user's cookie stayed alive (renewed on every hit,
    before the user was looked up) and became a session of whoever was
    later created under that name, with that account's role. The
    baseline now has sessions.user_id REFERENCES users(id) ON DELETE
    CASCADE; the principal is resolved by id and a session is renewed
    only after its user was found. RenameSession is gone.
  - M2: any user's password change deleted every other user's sessions.
    It ends that user's other sessions only.
  - L1: a password set on the user form ends that user's sessions (an
    administrator editing their own account keeps the current one).
  - L2: store, saslpasswd2 and Postfix reload errors were shown verbatim
    on the application form, the inbound upstream / recipients forms and
    the limit recalculation - pages a domain administrator reaches.
    Validation errors (app.ValidationError, inbound.ValidationError,
    store.ErrNotAutoRateLimit) keep their text; anything else is logged
    and shown as "Could not save ... Check the logs and try again."
  - L3: store.ListDMARCReports treated an empty domain list as "all". It
    takes a scope now (AllDomains or a list; an empty list is no rows),
    and the DMARC hub is open to the domain role as the plan says: the
    reports of the assigned domains, without the instance-wide ingest
    box. The menu entry was already shown to them and led to a 404.
  - I1: /static/ answered with a listing of the embedded assets. A path
    that is not a known asset is a 404.

Consequences
  - The global DMARC hub lists reports of domains that were deleted
    since, too.
  - dev/migrate1x (not in the tree) no longer carries sessions over:
    everyone signs in again after the transfer.
  - docs/schema-migrations.md: the sessions row.

Recorded, not changed - for the owner:
  - L4: the report-address select names the followed user and their
    address to every administrator of the domain, by default the global
    administrator's login name. The plan asks for it.
  - L5: a delegated inbound upstream may be any host and port, loopback
    and private ranges included - within the trusted-operator model; to
    be listed among the accepted risks in security.md.
  - L6: Account's profile is saved without the password; becomes a
    requirement once password-reset mails to users.email.
  - Still echoing an error's text: backup and domain import (global
    only), the domain form's validation messages.

Not checked by the review: anything needing the container (e2e, real
Postfix / DNS), CSP behaviour in a live browser.

  go test -count=1 ./internal/web/... ./internal/store/... ./internal/app/...
    ./internal/inbound/... ./internal/dmarc/... ./cmd/panel
      ok  (all eleven packages; dev/migrate1x also ok)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/store/dmarc.go

@@ -4,6 +4,7 @@ import (
 	"database/sql"
 	"errors"
 	"fmt"
+	"strings"
 	"time"
 )
 
@@ -167,34 +168,37 @@ func (s *Store) IncrDMARCParseFailures() error {
 	return s.SetSetting(DMARCParseFailuresKey, fmt.Sprintf("%d", n+1))
 }
 
-// ListDMARCReports returns recent summaries, optionally limited to domains.
-func (s *Store) ListDMARCReports(domains []string, limit int) ([]DMARCReportSummary, error) {
+// DMARCReportScope is whose reports a listing may return: every domain's
+// (AllDomains) or those of the named domains. A scope with neither is a viewer
+// who reaches nothing and gets no rows — an empty list is never "all"; see
+// SendLogFilter, which has the same shape.
+type DMARCReportScope struct {
+	AllDomains bool
+	Domains    []string
+}
+
+// ListDMARCReports returns recent summaries within the scope.
+func (s *Store) ListDMARCReports(scope DMARCReportScope, limit int) ([]DMARCReportSummary, error) {
 	if limit <= 0 {
 		limit = 50
 	}
-	var (
-		rows *sql.Rows
-		err  error
-	)
-	if len(domains) == 0 {
-		rows, err = s.db.Query(`
-			SELECT id, domain, reporter, period_begin, period_end, received_at, pass_count, fail_count
-			FROM dmarc_reports ORDER BY received_at DESC LIMIT ?`, limit)
-	} else {
-		placeholders := make([]any, 0, len(domains)+1)
-		q := `SELECT id, domain, reporter, period_begin, period_end, received_at, pass_count, fail_count
-			FROM dmarc_reports WHERE domain IN (`
-		for i, d := range domains {
-			if i > 0 {
-				q += ","
-			}
-			q += "?"
-			placeholders = append(placeholders, d)
+	q := `SELECT id, domain, reporter, period_begin, period_end, received_at, pass_count, fail_count
+		FROM dmarc_reports`
+	var args []any
+	if !scope.AllDomains {
+		if len(scope.Domains) == 0 {
+			return nil, nil
 		}
-		q += `) ORDER BY received_at DESC LIMIT ?`
-		placeholders = append(placeholders, limit)
-		rows, err = s.db.Query(q, placeholders...)
+		marks := make([]string, len(scope.Domains))
+		for i, d := range scope.Domains {
+			marks[i] = "?"
+			args = append(args, d)
+		}
+		q += " WHERE domain IN (" + strings.Join(marks, ",") + ")"
 	}
+	q += " ORDER BY received_at DESC LIMIT ?"
+	args = append(args, limit)
+	rows, err := s.db.Query(q, args...)
 	if err != nil {
 		return nil, fmt.Errorf("list dmarc reports: %w", err)
 	}
@@ -242,7 +246,7 @@ func (s *Store) GetDMARCReport(id int64) (DMARCReport, error) {
 
 // ListDMARCReportsForDomain returns summaries for one sending domain.
 func (s *Store) ListDMARCReportsForDomain(domain string, limit int) ([]DMARCReportSummary, error) {
-	return s.ListDMARCReports([]string{domain}, limit)
+	return s.ListDMARCReports(DMARCReportScope{Domains: []string{domain}}, limit)
 }
 
 // DMARCDomainRollup summarises pass/fail for a domain over the last windowDays.