panel-redesign: security review of 2.0 - sessions belong to a user by id

Stage 3, step 2. Reviewed by Fable (read-only), fixed by Sonnet with a
failing test before each fix, checked by Opus. No Critical or High
finding: route authorization, tenant isolation by id, the /server/
subtree guard, output encoding and the origin check were found sound.

Fixed
  - M1: a session was keyed by user name and had no link to the user. A
    deleted or renamed user's cookie stayed alive (renewed on every hit,
    before the user was looked up) and became a session of whoever was
    later created under that name, with that account's role. The
    baseline now has sessions.user_id REFERENCES users(id) ON DELETE
    CASCADE; the principal is resolved by id and a session is renewed
    only after its user was found. RenameSession is gone.
  - M2: any user's password change deleted every other user's sessions.
    It ends that user's other sessions only.
  - L1: a password set on the user form ends that user's sessions (an
    administrator editing their own account keeps the current one).
  - L2: store, saslpasswd2 and Postfix reload errors were shown verbatim
    on the application form, the inbound upstream / recipients forms and
    the limit recalculation - pages a domain administrator reaches.
    Validation errors (app.ValidationError, inbound.ValidationError,
    store.ErrNotAutoRateLimit) keep their text; anything else is logged
    and shown as "Could not save ... Check the logs and try again."
  - L3: store.ListDMARCReports treated an empty domain list as "all". It
    takes a scope now (AllDomains or a list; an empty list is no rows),
    and the DMARC hub is open to the domain role as the plan says: the
    reports of the assigned domains, without the instance-wide ingest
    box. The menu entry was already shown to them and led to a 404.
  - I1: /static/ answered with a listing of the embedded assets. A path
    that is not a known asset is a 404.

Consequences
  - The global DMARC hub lists reports of domains that were deleted
    since, too.
  - dev/migrate1x (not in the tree) no longer carries sessions over:
    everyone signs in again after the transfer.
  - docs/schema-migrations.md: the sessions row.

Recorded, not changed - for the owner:
  - L4: the report-address select names the followed user and their
    address to every administrator of the domain, by default the global
    administrator's login name. The plan asks for it.
  - L5: a delegated inbound upstream may be any host and port, loopback
    and private ranges included - within the trusted-operator model; to
    be listed among the accepted risks in security.md.
  - L6: Account's profile is saved without the password; becomes a
    requirement once password-reset mails to users.email.
  - Still echoing an error's text: backup and domain import (global
    only), the domain form's validation messages.

Not checked by the review: anything needing the container (e2e, real
Postfix / DNS), CSP behaviour in a live browser.

  go test -count=1 ./internal/web/... ./internal/store/... ./internal/app/...
    ./internal/inbound/... ./internal/dmarc/... ./cmd/panel
      ok  (all eleven packages; dev/migrate1x also ok)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/store/sessions.go

@@ -8,18 +8,19 @@ import (
 )
 
 // SessionRow is a persisted login session, keyed by the SHA-256 of its token
-// (see internal/web, which owns the token itself).
+// (see internal/web, which owns the token itself). It belongs to a user by id:
+// deleting the user deletes their sessions, and renaming them keeps them.
 type SessionRow struct {
-	Username  string
+	UserID    int64
 	ExpiresAt time.Time
 }
 
-// CreateSession inserts a new session row.
-func (s *Store) CreateSession(tokenHash, username string, expiresAt time.Time) error {
+// CreateSession inserts a new session row for a user.
+func (s *Store) CreateSession(tokenHash string, userID int64, expiresAt time.Time) error {
 	now := time.Now().UTC().Format(time.RFC3339)
 	_, err := s.db.Exec(
-		`INSERT INTO sessions (token_hash, username, created_at, expires_at) VALUES (?, ?, ?, ?)`,
-		tokenHash, username, now, expiresAt.UTC().Format(time.RFC3339),
+		`INSERT INTO sessions (token_hash, user_id, created_at, expires_at) VALUES (?, ?, ?, ?)`,
+		tokenHash, userID, now, expiresAt.UTC().Format(time.RFC3339),
 	)
 	if err != nil {
 		return fmt.Errorf("insert session: %w", err)
@@ -36,9 +37,9 @@ func (s *Store) LookupSession(tokenHash string) (SessionRow, bool, error) {
 		expiresAt string
 	)
 	err := s.db.QueryRow(
-		`SELECT username, expires_at FROM sessions WHERE token_hash = ?`,
+		`SELECT user_id, expires_at FROM sessions WHERE token_hash = ?`,
 		tokenHash,
-	).Scan(&row.Username, &expiresAt)
+	).Scan(&row.UserID, &expiresAt)
 	if errors.Is(err, sql.ErrNoRows) {
 		return SessionRow{}, false, nil
 	}
@@ -65,20 +66,6 @@ func (s *Store) RenewSession(tokenHash string, expiresAt time.Time) error {
 	return nil
 }
 
-// RenameSession updates the username carried by a session, keeping its
-// expiry, so a session stays usable after the administrator renames their own
-// account.
-func (s *Store) RenameSession(tokenHash, username string) error {
-	_, err := s.db.Exec(
-		`UPDATE sessions SET username = ? WHERE token_hash = ?`,
-		username, tokenHash,
-	)
-	if err != nil {
-		return fmt.Errorf("rename session: %w", err)
-	}
-	return nil
-}
-
 // DeleteSession removes a session row (logout, or a lookup finding it
 // expired).
 func (s *Store) DeleteSession(tokenHash string) error {
@@ -88,17 +75,26 @@ func (s *Store) DeleteSession(tokenHash string) error {
 	return nil
 }
 
-// DeleteOtherSessions removes every session except keepHash. It is called
-// when the administrator changes their password: a stolen cookie issued
-// under the old password must stop working, while the session performing the
-// change stays signed in.
-func (s *Store) DeleteOtherSessions(keepHash string) error {
-	if _, err := s.db.Exec(`DELETE FROM sessions WHERE token_hash != ?`, keepHash); err != nil {
+// DeleteOtherSessions removes every session of the user except keepHash. It is
+// called when the user changes their password: a stolen cookie issued under the
+// old password must stop working, while the session performing the change
+// stays signed in. Other users' sessions are not touched.
+func (s *Store) DeleteOtherSessions(userID int64, keepHash string) error {
+	if _, err := s.db.Exec(`DELETE FROM sessions WHERE user_id = ? AND token_hash != ?`, userID, keepHash); err != nil {
 		return fmt.Errorf("delete other sessions: %w", err)
 	}
 	return nil
 }
 
+// DeleteUserSessions removes every session of the user, for when somebody else
+// has set their password.
+func (s *Store) DeleteUserSessions(userID int64) error {
+	if _, err := s.db.Exec(`DELETE FROM sessions WHERE user_id = ?`, userID); err != nil {
+		return fmt.Errorf("delete user sessions: %w", err)
+	}
+	return nil
+}
+
 // DeleteExpiredSessions prunes rows whose expiry has already passed, so an
 // abandoned session (cookie never presented again) does not sit in the table
 // forever. It piggybacks on session creation rather than running as its own