release: 1.9.0

Application client IP allow-list restricts which addresses may submit as a SASL login; level-2 rate limits override the domain ceiling per application (higher or lower, capped at L1). Migration 0009, authips form, milter enforcement, export/import, and operator docs.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/milter/milter.go

@@ -35,6 +35,7 @@ type Store interface {
 	InsertRejected(e store.SendLogEntry) error
 	RateLimit(scope, ref string) (store.RateLimit, bool, error)
 	CountMessages(scope, ref string, since time.Time) (int64, error)
+	ApplicationByLogin(login string) (store.Application, error)
 }
 
 // session accumulates the fields of one message as the milter callbacks fire.
@@ -84,6 +85,10 @@ func (s *session) MailFrom(from string, m *milter.Modifier) (milter.Response, er
 	s.login = macro(m, "auth_authen")
 	s.rcpts = nil
 	s.subject = ""
+	if !s.authIPAllowed() {
+		s.recordRejected()
+		return milter.RespTempFail, nil
+	}
 	if s.overLimit() {
 		s.recordRejected()
 		return milter.RespTempFail, nil