panel-redesign: security review of 2.0 - sessions belong to a user by id

Stage 3, step 2. Reviewed by Fable (read-only), fixed by Sonnet with a
failing test before each fix, checked by Opus. No Critical or High
finding: route authorization, tenant isolation by id, the /server/
subtree guard, output encoding and the origin check were found sound.

Fixed
  - M1: a session was keyed by user name and had no link to the user. A
    deleted or renamed user's cookie stayed alive (renewed on every hit,
    before the user was looked up) and became a session of whoever was
    later created under that name, with that account's role. The
    baseline now has sessions.user_id REFERENCES users(id) ON DELETE
    CASCADE; the principal is resolved by id and a session is renewed
    only after its user was found. RenameSession is gone.
  - M2: any user's password change deleted every other user's sessions.
    It ends that user's other sessions only.
  - L1: a password set on the user form ends that user's sessions (an
    administrator editing their own account keeps the current one).
  - L2: store, saslpasswd2 and Postfix reload errors were shown verbatim
    on the application form, the inbound upstream / recipients forms and
    the limit recalculation - pages a domain administrator reaches.
    Validation errors (app.ValidationError, inbound.ValidationError,
    store.ErrNotAutoRateLimit) keep their text; anything else is logged
    and shown as "Could not save ... Check the logs and try again."
  - L3: store.ListDMARCReports treated an empty domain list as "all". It
    takes a scope now (AllDomains or a list; an empty list is no rows),
    and the DMARC hub is open to the domain role as the plan says: the
    reports of the assigned domains, without the instance-wide ingest
    box. The menu entry was already shown to them and led to a 404.
  - I1: /static/ answered with a listing of the embedded assets. A path
    that is not a known asset is a 404.

Consequences
  - The global DMARC hub lists reports of domains that were deleted
    since, too.
  - dev/migrate1x (not in the tree) no longer carries sessions over:
    everyone signs in again after the transfer.
  - docs/schema-migrations.md: the sessions row.

Recorded, not changed - for the owner:
  - L4: the report-address select names the followed user and their
    address to every administrator of the domain, by default the global
    administrator's login name. The plan asks for it.
  - L5: a delegated inbound upstream may be any host and port, loopback
    and private ranges included - within the trusted-operator model; to
    be listed among the accepted risks in security.md.
  - L6: Account's profile is saved without the password; becomes a
    requirement once password-reset mails to users.email.
  - Still echoing an error's text: backup and domain import (global
    only), the domain form's validation messages.

Not checked by the review: anything needing the container (e2e, real
Postfix / DNS), CSP behaviour in a live browser.

  go test -count=1 ./internal/web/... ./internal/store/... ./internal/app/...
    ./internal/inbound/... ./internal/dmarc/... ./cmd/panel
      ok  (all eleven packages; dev/migrate1x also ok)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/handlers/handlers_inbound.go

@@ -9,6 +9,7 @@ import (
 
 	"github.com/mixeme/selfpost/internal/dnscheck"
 	"github.com/mixeme/selfpost/internal/health"
+	"github.com/mixeme/selfpost/internal/inbound"
 	"github.com/mixeme/selfpost/internal/store"
 	"github.com/mixeme/selfpost/internal/web/auth"
 	"github.com/mixeme/selfpost/internal/web/validate"
@@ -225,6 +226,19 @@ func (h *Handlers) inboundFilter() (on bool, milter, action string) {
 	return true, h.cfg.InboundAntispamMilter, h.cfg.InboundAntispamAction
 }
 
+// inboundErrorMessage is what a form of the inbound domain page says about a
+// failed save. A validation error says what to fix and is shown as it is;
+// anything else (the reload of the Postfix maps, the database) goes to the log
+// and the page gets a fixed line.
+func inboundErrorMessage(err error, form, what string) string {
+	var validation *inbound.ValidationError
+	if errors.As(err, &validation) {
+		return err.Error()
+	}
+	logf("panel: inbound: save %s: %v", form, err)
+	return "Could not save " + what + ". Check the logs and try again."
+}
+
 func firstNonEmpty(ss ...string) string {
 	for _, s := range ss {
 		if s != "" {
@@ -271,7 +285,9 @@ func (h *Handlers) HandleInboundTransport(w http.ResponseWriter, r *http.Request
 	port := r.PostFormValue("port")
 	tlsMode := r.PostFormValue("tls_mode")
 	if err := h.inbound.SetTransport(d.ID, host, port, tlsMode); err != nil {
-		h.renderInboundDetail(w, r, http.StatusBadRequest, d, inboundDetailView{TransportErr: err.Error()})
+		h.renderInboundDetail(w, r, http.StatusBadRequest, d, inboundDetailView{
+			TransportErr: inboundErrorMessage(err, "upstream", "the upstream"),
+		})
 		return
 	}
 	http.Redirect(w, r, fmt.Sprintf("/inbound/domains/%d?saved=1", d.ID), http.StatusSeeOther)
@@ -289,7 +305,9 @@ func (h *Handlers) HandleInboundRecipients(w http.ResponseWriter, r *http.Reques
 	mode := r.PostFormValue("recipient_mode")
 	addrs := splitAddresses(r.PostFormValue("addresses"))
 	if err := h.inbound.SetRecipients(d.ID, mode, addrs); err != nil {
-		h.renderInboundDetail(w, r, http.StatusBadRequest, d, inboundDetailView{RecipientErr: err.Error()})
+		h.renderInboundDetail(w, r, http.StatusBadRequest, d, inboundDetailView{
+			RecipientErr: inboundErrorMessage(err, "recipients", "the recipients"),
+		})
 		return
 	}
 	http.Redirect(w, r, fmt.Sprintf("/inbound/domains/%d?recipients=1", d.ID), http.StatusSeeOther)