panel-redesign: security review of 2.0 - sessions belong to a user by id

Stage 3, step 2. Reviewed by Fable (read-only), fixed by Sonnet with a
failing test before each fix, checked by Opus. No Critical or High
finding: route authorization, tenant isolation by id, the /server/
subtree guard, output encoding and the origin check were found sound.

Fixed
  - M1: a session was keyed by user name and had no link to the user. A
    deleted or renamed user's cookie stayed alive (renewed on every hit,
    before the user was looked up) and became a session of whoever was
    later created under that name, with that account's role. The
    baseline now has sessions.user_id REFERENCES users(id) ON DELETE
    CASCADE; the principal is resolved by id and a session is renewed
    only after its user was found. RenameSession is gone.
  - M2: any user's password change deleted every other user's sessions.
    It ends that user's other sessions only.
  - L1: a password set on the user form ends that user's sessions (an
    administrator editing their own account keeps the current one).
  - L2: store, saslpasswd2 and Postfix reload errors were shown verbatim
    on the application form, the inbound upstream / recipients forms and
    the limit recalculation - pages a domain administrator reaches.
    Validation errors (app.ValidationError, inbound.ValidationError,
    store.ErrNotAutoRateLimit) keep their text; anything else is logged
    and shown as "Could not save ... Check the logs and try again."
  - L3: store.ListDMARCReports treated an empty domain list as "all". It
    takes a scope now (AllDomains or a list; an empty list is no rows),
    and the DMARC hub is open to the domain role as the plan says: the
    reports of the assigned domains, without the instance-wide ingest
    box. The menu entry was already shown to them and led to a 404.
  - I1: /static/ answered with a listing of the embedded assets. A path
    that is not a known asset is a 404.

Consequences
  - The global DMARC hub lists reports of domains that were deleted
    since, too.
  - dev/migrate1x (not in the tree) no longer carries sessions over:
    everyone signs in again after the transfer.
  - docs/schema-migrations.md: the sessions row.

Recorded, not changed - for the owner:
  - L4: the report-address select names the followed user and their
    address to every administrator of the domain, by default the global
    administrator's login name. The plan asks for it.
  - L5: a delegated inbound upstream may be any host and port, loopback
    and private ranges included - within the trusted-operator model; to
    be listed among the accepted risks in security.md.
  - L6: Account's profile is saved without the password; becomes a
    requirement once password-reset mails to users.email.
  - Still echoing an error's text: backup and domain import (global
    only), the domain form's validation messages.

Not checked by the review: anything needing the container (e2e, real
Postfix / DNS), CSP behaviour in a live browser.

  go test -count=1 ./internal/web/... ./internal/store/... ./internal/app/...
    ./internal/inbound/... ./internal/dmarc/... ./cmd/panel
      ok  (all eleven packages; dev/migrate1x also ok)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/handlers/handlers_dmarc_reports.go

@@ -38,13 +38,13 @@ func (h *Handlers) canViewDMARCDomain(p auth.Principal, d store.Domain) bool {
 	return p.CanAccessDomain(d.ID)
 }
 
-// HandleDMARCList is the global DMARC reports index.
+// HandleDMARCList is the DMARC reports hub. The global role sees every report
+// and the ingest statistics of the instance; a domain administrator sees the
+// reports of the sending domains assigned to them, and no ingest statistics
+// (the box describes the whole instance: its mailbox, its failures).
 func (h *Handlers) HandleDMARCList(w http.ResponseWriter, r *http.Request) {
 	p, ok := h.requireDMARC(w, r)
-	if !ok || !p.IsGlobal() {
-		if ok && !p.IsGlobal() {
-			http.NotFound(w, r)
-		}
+	if !ok {
 		return
 	}
 	assigned, err := h.assignedDomains(p)
@@ -53,24 +53,18 @@ func (h *Handlers) HandleDMARCList(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
 	}
-	names := make([]string, 0, len(assigned))
+	scope := store.DMARCReportScope{AllDomains: p.IsGlobal()}
 	domainIDs := make(map[string]int64, len(assigned))
 	for _, d := range assigned {
-		names = append(names, d.Name)
+		scope.Domains = append(scope.Domains, d.Name)
 		domainIDs[d.Name] = d.ID
 	}
-	reports, err := h.store.ListDMARCReports(names, 100)
+	reports, err := h.store.ListDMARCReports(scope, 100)
 	if err != nil {
 		logf("panel: dmarc list: %v", err)
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
 	}
-	stats, err := h.store.DMARCIngestStats()
-	if err != nil {
-		logf("panel: dmarc ingest stats: %v", err)
-		http.Error(w, "internal error", http.StatusInternalServerError)
-		return
-	}
 	rows := make([]view.DMARCReportRow, len(reports))
 	for i, rep := range reports {
 		rows[i] = dmarcRow(rep)
@@ -78,6 +72,17 @@ func (h *Handlers) HandleDMARCList(w http.ResponseWriter, r *http.Request) {
 			rows[i].DomainHref = view.DMARCDomainHref(id)
 		}
 	}
+	if !p.IsGlobal() {
+		page := view.NewDMARCHub(h.shellMeta(r), view.IngestInput{}).WithoutIngest().WithReports(rows)
+		h.view.Render(w, http.StatusOK, "dmarc", page)
+		return
+	}
+	stats, err := h.store.DMARCIngestStats()
+	if err != nil {
+		logf("panel: dmarc ingest stats: %v", err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
 	in := view.IngestInput{
 		OK: stats.IngestOK, KeptThisWeek: stats.KeptThisWeek, ParseFailures: stats.ParseFailures,
 		Hosted: h.dmarc.DefaultHostedSuggestion(), Host: h.cfg.Hostname,
@@ -135,7 +140,7 @@ func (h *Handlers) HandleDMARCDomain(w http.ResponseWriter, r *http.Request) {
 			Source: s.SourceIP, ThisRelay: relay[s.SourceIP], Pass: s.PassCount, Fail: s.FailCount, Disposition: s.Disposition,
 		}
 	}
-	page := view.NewDMARCDomain(h.shellMeta(r), d.ID, d.Name, p.IsGlobal(), pass, fail, windowDays,
+	page := view.NewDMARCDomain(h.shellMeta(r), d.ID, d.Name, true, pass, fail, windowDays,
 		dmarc.TightenPolicyHint(pass, fail, hints)).
 		WithSources(sourceRows).WithReports(reportRows)
 	h.view.Render(w, http.StatusOK, "dmarc-domain", page)
@@ -198,7 +203,7 @@ func (h *Handlers) HandleDMARCReport(w http.ResponseWriter, r *http.Request) {
 		Received: rep.ReceivedAt.UTC().Format("2006-01-02 15:04") + " UTC",
 		PolicyP:  rep.PolicyP, PolicySP: rep.PolicySP, PolicyPct: rep.PolicyPct,
 		PolicyADKIM: rep.PolicyADKIM, PolicyASPF: rep.PolicyASPF, Recipient: rep.Recipient,
-		Hub: p.IsGlobal(),
+		Hub: true,
 	}).WithRecords(records)
 	h.view.Render(w, http.StatusOK, "dmarc-report", page)
 }