panel-redesign: security review of 2.0 - sessions belong to a user by id

Stage 3, step 2. Reviewed by Fable (read-only), fixed by Sonnet with a
failing test before each fix, checked by Opus. No Critical or High
finding: route authorization, tenant isolation by id, the /server/
subtree guard, output encoding and the origin check were found sound.

Fixed
  - M1: a session was keyed by user name and had no link to the user. A
    deleted or renamed user's cookie stayed alive (renewed on every hit,
    before the user was looked up) and became a session of whoever was
    later created under that name, with that account's role. The
    baseline now has sessions.user_id REFERENCES users(id) ON DELETE
    CASCADE; the principal is resolved by id and a session is renewed
    only after its user was found. RenameSession is gone.
  - M2: any user's password change deleted every other user's sessions.
    It ends that user's other sessions only.
  - L1: a password set on the user form ends that user's sessions (an
    administrator editing their own account keeps the current one).
  - L2: store, saslpasswd2 and Postfix reload errors were shown verbatim
    on the application form, the inbound upstream / recipients forms and
    the limit recalculation - pages a domain administrator reaches.
    Validation errors (app.ValidationError, inbound.ValidationError,
    store.ErrNotAutoRateLimit) keep their text; anything else is logged
    and shown as "Could not save ... Check the logs and try again."
  - L3: store.ListDMARCReports treated an empty domain list as "all". It
    takes a scope now (AllDomains or a list; an empty list is no rows),
    and the DMARC hub is open to the domain role as the plan says: the
    reports of the assigned domains, without the instance-wide ingest
    box. The menu entry was already shown to them and led to a 404.
  - I1: /static/ answered with a listing of the embedded assets. A path
    that is not a known asset is a 404.

Consequences
  - The global DMARC hub lists reports of domains that were deleted
    since, too.
  - dev/migrate1x (not in the tree) no longer carries sessions over:
    everyone signs in again after the transfer.
  - docs/schema-migrations.md: the sessions row.

Recorded, not changed - for the owner:
  - L4: the report-address select names the followed user and their
    address to every administrator of the domain, by default the global
    administrator's login name. The plan asks for it.
  - L5: a delegated inbound upstream may be any host and port, loopback
    and private ranges included - within the trusted-operator model; to
    be listed among the accepted risks in security.md.
  - L6: Account's profile is saved without the password; becomes a
    requirement once password-reset mails to users.email.
  - Still echoing an error's text: backup and domain import (global
    only), the domain form's validation messages.

Not checked by the review: anything needing the container (e2e, real
Postfix / DNS), CSP behaviour in a live browser.

  go test -count=1 ./internal/web/... ./internal/store/... ./internal/app/...
    ./internal/inbound/... ./internal/dmarc/... ./cmd/panel
      ok  (all eleven packages; dev/migrate1x also ok)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/handlers/handlers_dmarc_pages_test.go

@@ -155,8 +155,9 @@ func TestDMARCPagesAreAbsentWithIngestOff(t *testing.T) {
 }
 
 // A domain administrator reaches the reports of the domains assigned to them
-// and nothing else: not the hub, not another tenant's domain page, not another
-// tenant's report. A report that does not exist is the same 404 as one that is
+// and nothing else: the hub lists only theirs and does not carry the ingest
+// statistics of the whole instance, and another tenant's domain page and report
+// are not there. A report that does not exist is the same 404 as one that is
 // not theirs.
 func TestDMARCPagesStayWithinTheViewersDomains(t *testing.T) {
 	s := newDMARCStand(t)
@@ -174,22 +175,31 @@ func TestDMARCPagesStayWithinTheViewersDomains(t *testing.T) {
 	}
 	ops := domainAdmin(t, s.h.store, "ops", s.d.ID)
 
-	// Their own domain and report are theirs; the way back to the hub is not
-	// offered, since the hub is not theirs.
+	// The hub is open to them: their own domain's reports, no one else's, and
+	// not the statistics of the instance's ingest box.
+	hub := send(s.h.HandleDMARCList, &ops, "GET", "/outbound/dmarc", nil, nil)
+	if hub.Code != http.StatusOK {
+		t.Fatalf("hub for its administrator = %d, want 200: %s", hub.Code, hub.Body.String())
+	}
+	has(t, "hub for its administrator", hub.Body.String(), `<h1 class="title is-3">DMARC reports</h1>`, `<h2>Recent reports</h2>`,
+		`<a href="/outbound/dmarc/domains/1">example.org</a>`, `Outlook.com`, `href="/outbound/dmarc/reports/`+idStr(s.reportID)+`"`)
+	lacks(t, "hub for its administrator", hub.Body.String(), "other.example.net", "google.com",
+		`/outbound/dmarc/reports/`+idStr(otherReport)+`"`, `<h2>Ingest</h2>`, `dmarc-reports@mail.example.org`,
+		`parse failure`, `Last report`, `Retention`)
+
+	// Their own domain and report are theirs, and so is the way back to the hub.
 	own := send(s.h.HandleDMARCDomain, &ops, "GET", "/outbound/dmarc/domains/1", map[string]string{"id": "1"}, nil)
 	if own.Code != http.StatusOK {
 		t.Fatalf("own domain = %d", own.Code)
 	}
-	has(t, "domain for its administrator", own.Body.String(), `<h1 class="title is-3">example.org</h1>`)
-	lacks(t, "domain for its administrator", own.Body.String(), `<a href="/outbound/dmarc">`)
+	has(t, "domain for its administrator", own.Body.String(), `<h1 class="title is-3">example.org</h1>`, `<a href="/outbound/dmarc">DMARC reports</a>`)
 	rep := send(s.h.HandleDMARCReport, &ops, "GET", "/outbound/dmarc/reports/"+idStr(s.reportID), map[string]string{"id": idStr(s.reportID)}, nil)
 	if rep.Code != http.StatusOK {
 		t.Fatalf("own report = %d", rep.Code)
 	}
-	lacks(t, "report for its administrator", rep.Body.String(), `<a href="/outbound/dmarc">`)
+	has(t, "report for its administrator", rep.Body.String(), `<a href="/outbound/dmarc">DMARC reports</a>`)
 
 	for name, code := range map[string]int{
-		"hub": send(s.h.HandleDMARCList, &ops, "GET", "/outbound/dmarc", nil, nil).Code,
 		"another tenant's domain": send(s.h.HandleDMARCDomain, &ops, "GET", "/outbound/dmarc/domains/"+idStr(other.ID),
 			map[string]string{"id": idStr(other.ID)}, nil).Code,
 		"another tenant's report": send(s.h.HandleDMARCReport, &ops, "GET", "/outbound/dmarc/reports/"+idStr(otherReport),
@@ -202,3 +212,32 @@ func TestDMARCPagesStayWithinTheViewersDomains(t *testing.T) {
 		}
 	}
 }
+
+// A domain administrator with no outbound domain is not shown every tenant's
+// reports because their own list is empty: the hub has no rows, and no error.
+func TestDMARCHubForAnAdministratorWithoutOutboundDomains(t *testing.T) {
+	s := newDMARCStand(t)
+	nobody := domainAdmin(t, s.h.store, "nobody")
+
+	rec := send(s.h.HandleDMARCList, &nobody, "GET", "/outbound/dmarc", nil, nil)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("hub = %d, want 200: %s", rec.Code, rec.Body.String())
+	}
+	has(t, "hub", rec.Body.String(), `No reports yet.`)
+	lacks(t, "hub", rec.Body.String(), "example.org", "Outlook.com", `<table`, `<h2>Ingest</h2>`)
+}
+
+// The global role sees the ingest box and every report, including those of a
+// domain that has since been removed.
+func TestDMARCHubForTheGlobalRoleSeesEverything(t *testing.T) {
+	s := newDMARCStand(t)
+	if _, err := s.h.store.InsertDMARCReport(store.DMARCReport{
+		Domain: "gone.example.net", Reporter: "yahoo.com", ReportID: "gone", ReceivedAt: time.Now(),
+		PeriodBegin: time.Now().Add(-24 * time.Hour), PeriodEnd: time.Now(), PassCount: 3,
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	body := getBody(t, s.h.HandleDMARCList, "/outbound/dmarc")
+	has(t, "hub", body, `<h2>Ingest</h2>`, `<h2>Recent reports</h2>`, `example.org`, `Outlook.com`, `gone.example.net`, `yahoo.com`)
+}