panel-redesign: security review of 2.0 - sessions belong to a user by id

Stage 3, step 2. Reviewed by Fable (read-only), fixed by Sonnet with a
failing test before each fix, checked by Opus. No Critical or High
finding: route authorization, tenant isolation by id, the /server/
subtree guard, output encoding and the origin check were found sound.

Fixed
  - M1: a session was keyed by user name and had no link to the user. A
    deleted or renamed user's cookie stayed alive (renewed on every hit,
    before the user was looked up) and became a session of whoever was
    later created under that name, with that account's role. The
    baseline now has sessions.user_id REFERENCES users(id) ON DELETE
    CASCADE; the principal is resolved by id and a session is renewed
    only after its user was found. RenameSession is gone.
  - M2: any user's password change deleted every other user's sessions.
    It ends that user's other sessions only.
  - L1: a password set on the user form ends that user's sessions (an
    administrator editing their own account keeps the current one).
  - L2: store, saslpasswd2 and Postfix reload errors were shown verbatim
    on the application form, the inbound upstream / recipients forms and
    the limit recalculation - pages a domain administrator reaches.
    Validation errors (app.ValidationError, inbound.ValidationError,
    store.ErrNotAutoRateLimit) keep their text; anything else is logged
    and shown as "Could not save ... Check the logs and try again."
  - L3: store.ListDMARCReports treated an empty domain list as "all". It
    takes a scope now (AllDomains or a list; an empty list is no rows),
    and the DMARC hub is open to the domain role as the plan says: the
    reports of the assigned domains, without the instance-wide ingest
    box. The menu entry was already shown to them and led to a 404.
  - I1: /static/ answered with a listing of the embedded assets. A path
    that is not a known asset is a 404.

Consequences
  - The global DMARC hub lists reports of domains that were deleted
    since, too.
  - dev/migrate1x (not in the tree) no longer carries sessions over:
    everyone signs in again after the transfer.
  - docs/schema-migrations.md: the sessions row.

Recorded, not changed - for the owner:
  - L4: the report-address select names the followed user and their
    address to every administrator of the domain, by default the global
    administrator's login name. The plan asks for it.
  - L5: a delegated inbound upstream may be any host and port, loopback
    and private ranges included - within the trusted-operator model; to
    be listed among the accepted risks in security.md.
  - L6: Account's profile is saved without the password; becomes a
    requirement once password-reset mails to users.email.
  - Still echoing an error's text: backup and domain import (global
    only), the domain form's validation messages.

Not checked by the review: anything needing the container (e2e, real
Postfix / DNS), CSP behaviour in a live browser.

  go test -count=1 ./internal/web/... ./internal/store/... ./internal/app/...
    ./internal/inbound/... ./internal/dmarc/... ./cmd/panel
      ok  (all eleven packages; dev/migrate1x also ok)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/view/dmarc.go

@@ -30,11 +30,14 @@ func FormatReceived(t time.Time) string { return t.UTC().Format("01-02 15:04") }
 // ---- The hub
 
 // DMARCHub is the data of the DMARC reports hub: whether reports are arriving
-// and the latest of them.
+// and the latest of them. The ingest box describes the whole instance (the
+// hosted mailbox, the reports kept across every domain), so it is drawn only
+// for the viewer it belongs to — see WithoutIngest.
 type DMARCHub struct {
 	Meta
 	Head Head
 
+	IngestOn    bool
 	Ingest      Box
 	IngestFacts []Fact
 
@@ -104,7 +107,8 @@ func NewDMARCHub(m Meta, in IngestInput) *DMARCHub {
 			Lead: Rich("How receivers saw mail claiming to be from your domains. Aggregate (", Code("rua="),
 				") only; open a report for the parsed XML."),
 		},
-		Ingest: Box{No: "01", Title: "Ingest", End: Rich(TagOf(status, label))},
+		IngestOn: true,
+		Ingest:   Box{No: "01", Title: "Ingest", End: Rich(TagOf(status, label))},
 		IngestFacts: []Fact{
 			last,
 			{Label: "This week", Value: Plain(FormatCount(int64(in.KeptThisWeek)) + " kept · " + plural(int64(in.ParseFailures), "parse failure", "parse failures"))},
@@ -116,6 +120,15 @@ func NewDMARCHub(m Meta, in IngestInput) *DMARCHub {
 	}
 }
 
+// WithoutIngest leaves the ingest box out, for a viewer who reaches some of the
+// domains and not the instance: the box is about all of them, so what it says
+// is not theirs to read. The reports box is then the page's first and only one.
+func (p *DMARCHub) WithoutIngest() *DMARCHub {
+	p.IngestOn = false
+	p.Recent.No = "01"
+	return p
+}
+
 // WithReports sets the table of the latest reports.
 func (p *DMARCHub) WithReports(rows []DMARCReportRow) *DMARCHub {
 	p.Rows = rows

internal/web/view/static.go

@@ -40,6 +40,9 @@ func buildStaticETags() map[string]string {
 }
 
 // StaticHandler serves the embedded assets under /static/ with a content ETag.
+// A path that is not one of those assets — the folder itself included — is a
+// 404: the file server would otherwise answer the folder with a listing of
+// everything the binary embeds.
 //
 // Cache-Control is no-cache rather than a max-age: it lets the browser keep the
 // copy but requires it to revalidate, so an asset that changed is picked up on
@@ -50,10 +53,13 @@ func buildStaticETags() map[string]string {
 func StaticHandler() http.Handler {
 	files := http.FileServer(http.FS(assetsFS))
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if etag, ok := staticETags[path.Clean(r.URL.Path)]; ok {
-			w.Header().Set("ETag", etag)
-			w.Header().Set("Cache-Control", "no-cache")
+		etag, ok := staticETags[path.Clean(r.URL.Path)]
+		if !ok {
+			http.NotFound(w, r)
+			return
 		}
+		w.Header().Set("ETag", etag)
+		w.Header().Set("Cache-Control", "no-cache")
 		files.ServeHTTP(w, r)
 	})
 }

internal/web/view/static_test.go

@@ -106,3 +106,26 @@ func TestOFLTravelsWithFonts(t *testing.T) {
 		t.Error("GET /static/OFL.txt did not serve the OFL text")
 	}
 }
+
+// /static/ is a set of known assets, not a directory to browse: the folder, and
+// a path that is not an asset, answer 404 rather than a listing of what the
+// binary embeds.
+func TestStaticDoesNotListOrServeWhatIsNotAnAsset(t *testing.T) {
+	for _, target := range []string{"/static/", "/static", "/static/nope", "/static/../static/", "/static/panel.css/../"} {
+		rec := serveStatic(target, nil)
+		if rec.Code != http.StatusNotFound {
+			t.Errorf("GET %s = %d, want 404:\n%s", target, rec.Code, rec.Body.String())
+		}
+		if strings.Contains(rec.Body.String(), "panel.css") {
+			t.Errorf("GET %s lists the assets:\n%s", target, rec.Body.String())
+		}
+	}
+
+	rec := serveStatic("/static/panel.css", nil)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("GET /static/panel.css = %d, want 200", rec.Code)
+	}
+	if got, want := rec.Header().Get("ETag"), staticETags["/static/panel.css"]; got == "" || got != want {
+		t.Errorf("ETag of panel.css = %q, want %q", got, want)
+	}
+}

internal/web/view/templates/dmarc.html

@@ -1,13 +1,17 @@
 {{/* DMARC reports (mockup dmarc.html): whether aggregate reports are arriving,
-     and the latest of them across the domains the viewer reaches. */}}
+     and the latest of them across the domains the viewer reaches. The ingest box
+     is the instance's, so a viewer who reaches only some domains gets the
+     reports alone. */}}
 {{define "content"}}
 {{template "page_head" .Head}}
 
+{{if .IngestOn}}
 {{template "box_open" .Ingest}}
 {{template "body_open"}}
 {{template "facts" .IngestFacts}}
 {{template "body_close"}}
 {{template "box_close"}}
+{{end}}
 
 {{template "box_open" .Recent}}
 {{if .Rows}}