release: 1.9.0

Application client IP allow-list restricts which addresses may submit as a SASL login; level-2 rate limits override the domain ceiling per application (higher or lower, capped at L1). Migration 0009, authips form, milter enforcement, export/import, and operator docs.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/app/service.go

@@ -199,12 +199,13 @@ func (s *Service) RateLimit(appID int64) (store.RateLimit, bool, error) {
 	return s.store.GetRateLimit(store.RateLimitScopeApp, appID)
 }
 
-// SaveRateLimit stores the application-level trusted-IP override (guide § Rate
-// limiting). The caller has validated the IPs and numbers (security.md); the
-// milter reads the row live, so no reload is needed.
+// SaveRateLimit stores the application-level rate limit (guide § Rate
+// limiting). The caller has validated the numbers (security.md); the milter
+// reads the row live, so no reload is needed.
 func (s *Service) SaveRateLimit(appID int64, rl store.RateLimit) error {
 	rl.Scope = store.RateLimitScopeApp
 	rl.RefID = appID
+	rl.AllowedIPs = nil
 	return s.store.SetRateLimit(rl)
 }
 
@@ -214,6 +215,12 @@ func (s *Service) ClearRateLimit(appID int64) error {
 	return s.store.DeleteRateLimit(store.RateLimitScopeApp, appID)
 }
 
+// UpdateAuthIPs sets client IP restriction for an application (guide § Rate
+// limiting — authorization). The caller has validated the IPs (security.md).
+func (s *Service) UpdateAuthIPs(appID int64, restrict bool, ips []string) error {
+	return s.store.UpdateApplicationAuthIPs(appID, restrict, ips)
+}
+
 // PurgeDomainSASL removes the SASL accounts of every application bound to a
 // domain. It must be called before the domain's registry rows are cascade-
 // deleted, while the logins are still known (product.md). The registry rows and