release: 1.9.0

Application client IP allow-list restricts which addresses may submit as a SASL login; level-2 rate limits override the domain ceiling per application (higher or lower, capped at L1). Migration 0009, authips form, milter enforcement, export/import, and operator docs.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/web/handlers/handlers_apps.go

@@ -46,7 +46,7 @@ type detailView struct {
 type appRateLimitView struct {
 	store.Application
 	HasLimit       bool
-	IPsText        string
+	AuthIPsText    string
 	MaxText        string
 	WindowVal      string
 	Mode           string
@@ -116,7 +116,7 @@ func (h *Handlers) renderDomainDetail(w http.ResponseWriter, r *http.Request, st
 		appViews = append(appViews, appRateLimitView{
 			Application:    a,
 			HasLimit:       ok && rl.Active(),
-			IPsText:        strings.Join(rl.AllowedIPs, "\n"),
+			AuthIPsText:    strings.Join(a.AuthAllowedIPs, "\n"),
 			MaxText:        intOrBlank(rl.MaxMessages),
 			WindowVal:      windowOrDefault(rl.WindowSeconds),
 			Mode:           mode,
@@ -332,6 +332,8 @@ func detailFlash(r *http.Request) string {
 		return "Application address mode updated."
 	case r.URL.Query().Get("ratelimit") != "":
 		return "Rate limit updated."
+	case r.URL.Query().Get("authips") != "":
+		return "Client IP restriction updated."
 	case r.URL.Query().Get("recalculated") != "":
 		return "Auto rate limit recalculated."
 	case r.URL.Query().Get("dmarc") != "":

internal/web/handlers/handlers_ratelimit.go

@@ -98,7 +98,7 @@ func parseDomainRateLimitForm(r *http.Request, l1Max int) (rateLimitInput, error
 	return rateLimitInput{mode: store.RateLimitModeManual, maxMessages: maxMessages, windowSeconds: windowSeconds}, nil
 }
 
-func parseAppRateLimitForm(r *http.Request, l1Max, domainMax int, domainActive bool) (rateLimitInput, error) {
+func parseAppRateLimitForm(r *http.Request, l1Max int) (rateLimitInput, error) {
 	if err := r.ParseForm(); err != nil {
 		return rateLimitInput{}, fmt.Errorf("invalid form submission")
 	}
@@ -110,20 +110,12 @@ func parseAppRateLimitForm(r *http.Request, l1Max, domainMax int, domainActive b
 		return rateLimitInput{}, err
 	}
 
-	ips, err := parseIPList(r.PostFormValue("allowed_ips"))
-	if err != nil {
-		return rateLimitInput{}, err
-	}
-	if len(ips) == 0 {
-		return rateLimitInput{}, fmt.Errorf("enter at least one trusted client IP for an application override")
-	}
-
 	if mode == store.RateLimitModeAuto {
 		mult, err := parseAutoMultiplier(r.PostFormValue("auto_multiplier"))
 		if err != nil {
 			return rateLimitInput{}, err
 		}
-		return rateLimitInput{mode: mode, ips: ips, autoMultiplier: mult}, nil
+		return rateLimitInput{mode: mode, autoMultiplier: mult}, nil
 	}
 
 	rawMax := strings.TrimSpace(r.PostFormValue("max_messages"))
@@ -137,14 +129,29 @@ func parseAppRateLimitForm(r *http.Request, l1Max, domainMax int, domainActive b
 	if maxMessages > l1Max {
 		return rateLimitInput{}, fmt.Errorf("message limit cannot exceed the level-1 backstop (%d)", l1Max)
 	}
-	if domainActive && maxMessages <= domainMax {
-		return rateLimitInput{}, fmt.Errorf("application override must be greater than the domain limit (%d)", domainMax)
-	}
 	windowSeconds, err := parsePositiveInt(r.PostFormValue("window_seconds"), defaultRateLimitWindowSeconds)
 	if err != nil || windowSeconds <= 0 {
 		return rateLimitInput{}, fmt.Errorf("enter a time window greater than zero seconds")
 	}
-	return rateLimitInput{mode: store.RateLimitModeManual, ips: ips, maxMessages: maxMessages, windowSeconds: windowSeconds}, nil
+	return rateLimitInput{mode: store.RateLimitModeManual, maxMessages: maxMessages, windowSeconds: windowSeconds}, nil
+}
+
+func parseAppAuthIPsForm(r *http.Request) (bool, []string, error) {
+	if err := r.ParseForm(); err != nil {
+		return false, nil, fmt.Errorf("invalid form submission")
+	}
+	restrict := r.PostFormValue("auth_ip_restrict") != ""
+	if !restrict {
+		return false, nil, nil
+	}
+	ips, err := parseIPList(r.PostFormValue("auth_allowed_ips"))
+	if err != nil {
+		return false, nil, err
+	}
+	if len(ips) == 0 {
+		return false, nil, fmt.Errorf("enter at least one client IP when the allow-list is enabled")
+	}
+	return true, ips, nil
 }
 
 func parseIPList(raw string) ([]string, error) {
@@ -206,14 +213,7 @@ func (h *Handlers) HandleAppRateLimit(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
 	}
-	domainRL, domainOK, err := h.domains.RateLimit(d.ID)
-	if err != nil {
-		logf("panel: domain %d: rate limit: %v", d.ID, err)
-		http.Error(w, "internal error", http.StatusInternalServerError)
-		return
-	}
-	domainActive := domainOK && domainRL.Active()
-	in, err := parseAppRateLimitForm(r, h.l1Messages(), domainRL.MaxMessages, domainActive)
+	in, err := parseAppRateLimitForm(r, h.l1Messages())
 	if err != nil {
 		h.renderDomainDetail(w, r, http.StatusBadRequest, d, detailView{
 			FormMode:     store.AddressModeWildcard,
@@ -229,6 +229,32 @@ func (h *Handlers) HandleAppRateLimit(w http.ResponseWriter, r *http.Request) {
 	http.Redirect(w, r, fmt.Sprintf("/domains/%d?ratelimit=1", a.DomainID), http.StatusSeeOther)
 }
 
+func (h *Handlers) HandleAppAuthIPs(w http.ResponseWriter, r *http.Request) {
+	a, ok := h.lookupApplication(w, r)
+	if !ok {
+		return
+	}
+	d, err := h.domains.Get(a.DomainID)
+	if err != nil {
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	restrict, ips, err := parseAppAuthIPsForm(r)
+	if err != nil {
+		h.renderDomainDetail(w, r, http.StatusBadRequest, d, detailView{
+			FormMode:     store.AddressModeWildcard,
+			RateLimitErr: fmt.Sprintf("%s: %s", a.Login, err.Error()),
+		})
+		return
+	}
+	if err := h.apps.UpdateAuthIPs(a.ID, restrict, ips); err != nil {
+		logf("panel: application %d: save auth IPs: %v", a.ID, err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	http.Redirect(w, r, fmt.Sprintf("/domains/%d?authips=1", a.DomainID), http.StatusSeeOther)
+}
+
 func (h *Handlers) HandleDomainRateLimitRecalc(w http.ResponseWriter, r *http.Request) {
 	d, ok := h.lookupDomain(w, r)
 	if !ok {
@@ -294,7 +320,6 @@ func (h *Handlers) applyAppRateLimit(in rateLimitInput, appID int64) error {
 	rl := store.RateLimit{
 		Scope:          store.RateLimitScopeApp,
 		RefID:          appID,
-		AllowedIPs:     in.ips,
 		Mode:           in.mode,
 		MaxMessages:    in.maxMessages,
 		WindowSeconds:  in.windowSeconds,

internal/web/handlers/handlers_ratelimit_test.go

@@ -50,52 +50,52 @@ func TestParseAppRateLimitForm(t *testing.T) {
 
 	in, err := parseAppRateLimitForm(form(url.Values{
 		"mode":           {"manual"},
-		"allowed_ips":    {"203.0.113.10"},
 		"max_messages":   {"80"},
 		"window_seconds": {"3600"},
-	}), 100, 40, true)
-	if err != nil || in.maxMessages != 80 || len(in.ips) != 1 {
-		t.Fatalf("valid app override = %+v err=%v", in, err)
+	}), 100)
+	if err != nil || in.maxMessages != 80 {
+		t.Fatalf("valid app limit = %+v err=%v", in, err)
+	}
+
+	in, err = parseAppRateLimitForm(form(url.Values{"max_messages": {""}}), 100)
+	if err != nil || !in.clear {
+		t.Fatalf("empty max should clear: %+v err=%v", in, err)
 	}
 
 	_, err = parseAppRateLimitForm(form(url.Values{
 		"mode":           {"manual"},
-		"max_messages":   {"80"},
-		"window_seconds": {"3600"},
-	}), 100, 40, true)
-	if err == nil || !strings.Contains(err.Error(), "trusted client IP") {
-		t.Fatalf("missing IPs want error, got %v", err)
-	}
-
-	_, err = parseAppRateLimitForm(form(url.Values{
-		"mode":           {"manual"},
-		"allowed_ips":    {"203.0.113.10"},
-		"max_messages":   {"40"},
-		"window_seconds": {"3600"},
-	}), 100, 40, true)
-	if err == nil || !strings.Contains(err.Error(), "greater than the domain") {
-		t.Fatalf("app <= domain want error, got %v", err)
-	}
-
-	_, err = parseAppRateLimitForm(form(url.Values{
-		"mode":           {"manual"},
-		"allowed_ips":    {"203.0.113.10"},
 		"max_messages":   {"150"},
 		"window_seconds": {"3600"},
-	}), 100, 0, false)
+	}), 100)
 	if err == nil || !strings.Contains(err.Error(), "level-1") {
 		t.Fatalf("over L1 want error, got %v", err)
 	}
+}
 
-	// No domain limit: any app ceiling ≤ L1 is fine.
-	in, err = parseAppRateLimitForm(form(url.Values{
-		"mode":           {"manual"},
-		"allowed_ips":    {"203.0.113.10"},
-		"max_messages":   {"50"},
-		"window_seconds": {"3600"},
-	}), 100, 0, false)
-	if err != nil || in.maxMessages != 50 {
-		t.Fatalf("app without domain = %+v err=%v", in, err)
+func TestParseAppAuthIPsForm(t *testing.T) {
+	t.Parallel()
+	form := func(vals url.Values) *http.Request {
+		r := httptest.NewRequest(http.MethodPost, "/", strings.NewReader(vals.Encode()))
+		r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		return r
+	}
+
+	restrict, ips, err := parseAppAuthIPsForm(form(url.Values{
+		"auth_ip_restrict": {"1"},
+		"auth_allowed_ips":   {"203.0.113.10"},
+	}))
+	if err != nil || !restrict || len(ips) != 1 {
+		t.Fatalf("enabled with IP = restrict=%v ips=%v err=%v", restrict, ips, err)
+	}
+
+	restrict, ips, err = parseAppAuthIPsForm(form(url.Values{}))
+	if err != nil || restrict || ips != nil {
+		t.Fatalf("disabled = restrict=%v ips=%v err=%v", restrict, ips, err)
+	}
+
+	_, _, err = parseAppAuthIPsForm(form(url.Values{"auth_ip_restrict": {"1"}}))
+	if err == nil || !strings.Contains(err.Error(), "at least one client IP") {
+		t.Fatalf("enabled without IPs want error, got %v", err)
 	}
 }
 

internal/web/view/static/panel.css

@@ -369,12 +369,12 @@ button.danger:hover, a.danger:hover { background: var(--danger-fill-hover); }
 .app .actions > .panel .check-col > .muted { margin: 0; }
 /* Address mode select ‖ trusted-IP field: same top offset and control height. */
 .app .actions > .panel .check-col > .muted + form > select:first-of-type,
-.app .actions > .panel .check-col > .muted + form > textarea[name="allowed_ips"] {
+.app .actions > .panel .check-col > .muted + form > textarea[name="auth_allowed_ips"] {
   margin-top: 0.45rem;
   min-height: 2.55rem;
   box-sizing: border-box;
 }
-.app .actions > .panel .check-col > .muted + form > textarea[name="allowed_ips"] {
+.app .actions > .panel .check-col > .muted + form > textarea[name="auth_allowed_ips"] {
   field-sizing: fixed;
   overflow-y: auto;
 }

internal/web/view/templates/domain_detail.html

@@ -328,16 +328,29 @@
                 </form>
               </div>
               <div class="check-col">
-                <p class="check-col-title">Optional trusted-IP override
+                <p class="check-col-title">Client IP allow-list
+                  {{if .AuthIPRestrict}}<span class="st st-ok">active</span>{{else}}<span class="st st-unknown">off</span>{{end}}</p>
+                <p class="muted">When enabled, only these addresses may authenticate
+                and submit mail as this application. When off, any client IP is allowed.</p>
+                <form method="post" action="/applications/{{.ID}}/authips">
+                  <label class="check-row">
+                    <input type="checkbox" name="auth_ip_restrict" value="1"
+                           {{if .AuthIPRestrict}}checked{{end}}>
+                    Restrict to listed IPs
+                  </label>
+                  <textarea name="auth_allowed_ips" rows="2" placeholder="203.0.113.10"
+                            aria-label="Allowed client IPs">{{.AuthIPsText}}</textarea>
+                  <button type="submit">Save IP restriction</button>
+                </form>
+              </div>
+              <div class="check-col">
+                <p class="check-col-title">Level-2 rate limit
                   {{if .HasLimit}}<span class="st st-ok">active</span>{{else}}<span class="st st-unknown">inactive</span>{{end}}</p>
-                <p class="muted">One per line or comma-separated.</p>
+                <p class="muted">Overrides the domain limit for this application — the
+                ceiling may be <em>higher or lower</em> than the domain setting
+                (≤ level&nbsp;1). When unset, the domain limit{{if $.DomainHasRL}}
+                ({{$.DomainRLMaxNum}}){{end}} or level&nbsp;1 applies.</p>
                 <form id="rl-{{.ID}}" method="post" action="/applications/{{.ID}}/ratelimit">
-                  <textarea name="allowed_ips" rows="1" placeholder="203.0.113.10"
-                            aria-label="Trusted client IPs">{{.IPsText}}</textarea>
-                  <p class="muted">These IPs get a higher ceiling than the domain
-                  (≤ level&nbsp;1) and skip the domain check; everyone else uses
-                  the domain level-2 limit{{if $.DomainHasRL}} ({{$.DomainRLMaxNum}}){{end}}
-                  if set, otherwise level&nbsp;1.</p>
                   <label for="mode-{{.ID}}">Limit mode</label>
                   <select id="mode-{{.ID}}" name="mode" data-ratelimit-mode>
                     <option value="manual" {{if not .IsAuto}}selected{{end}}>Manual</option>

internal/web/view/templates/help_drawer.html

@@ -130,10 +130,11 @@
     digits, <code>.</code>, <code>-</code> and <code>_</code>. The password is
     shown once.</p>
     <p>Address mode is which From addresses this application may use: any
-    address of the domain, or a fixed list. A trusted-IP override gives those
-    clients a higher ceiling than the domain (still ≤ level 1) and skips the
-    domain check; everyone else uses the domain limit if set, otherwise level
-    1.</p>
+    address of the domain, or a fixed list. Client IP allow-list, when enabled,
+    restricts which addresses may authenticate as this application; when off,
+    any client IP is allowed. The level-2 rate limit <em>overrides</em> the
+    domain limit for that application — you can set a ceiling above or below
+    the domain (still ≤ level&nbsp;1). Independent of the client IP allow-list.</p>
     {{template "help_more" true}}
   </article>
 
@@ -141,8 +142,8 @@
     <h2>Domain settings</h2>
     <p>Aggregate reports (<code>rua=</code>) inherit the Settings default, or
     you override them per domain. Level 2 is an optional ceiling for all
-    senders on this domain; it must be ≤ level 1. Application overrides live on
-    each application.</p>
+    senders on this domain; it must be ≤ level 1. Each application may override
+    that domain limit (higher or lower, still ≤ level&nbsp;1).</p>
     {{template "help_more" true}}
   </article>
 

internal/web/view/templates/settings.html

@@ -128,9 +128,10 @@ every other session; this one stays signed in.</p>
   <p class="muted">Optional ceiling for <em>all</em> senders on a domain. When
   unset, only level&nbsp;1 applies. Must be ≤ level&nbsp;1.</p>
 
-  <label>Level 2 — application (trusted IPs)</label>
-  <p class="muted">Optional override: list client IPs and a ceiling
-  <em>strictly above</em> the domain limit (still ≤ level&nbsp;1). Those IPs
-  skip the domain check; everyone else stays under the domain (or level&nbsp;1).</p>
+  <label>Level 2 — application</label>
+  <p class="muted">Overrides the domain limit for one application. The ceiling
+  may be <em>above or below</em> the domain setting (≤ level&nbsp;1). When unset,
+  the domain limit or level&nbsp;1 applies. Independent of the client IP
+  allow-list.</p>
 </div>
 {{end}}

internal/web/view/templates_test.go

@@ -283,8 +283,8 @@ func TestDomainDetailPageHasPairedCards(t *testing.T) {
 	if !strings.Contains(src, "Level 1 backstop") {
 		t.Error("domain rate limit should show a Level 1 backstop line")
 	}
-	if !strings.Contains(src, "Trusted client IPs") {
-		t.Error("application override should ask for trusted client IPs")
+	if !strings.Contains(src, "Restrict to listed IPs") {
+		t.Error("application should offer client IP allow-list")
 	}
 	if strings.Contains(src, `id="spf-dmarc"`) {
 		t.Error("SPF should sit with DKIM, not with DMARC")
@@ -306,7 +306,7 @@ func TestSettingsPageDocumentsRateLimits(t *testing.T) {
 	for _, want := range []string{
 		"RATE_LIMIT_MESSAGES_PER_IP",
 		"Level 2 — domain",
-		"trusted IPs",
+		"Level 2 — application",
 		"{{.L1Messages}} messages / {{.L1Window}} seconds",
 		`name="send_log_retention_days"`,
 	} {

internal/web/web.go

@@ -178,6 +178,7 @@ func (s *Server) Handler() http.Handler {
 	authed.HandleFunc("POST /domains/{id}/dmarc", h.HandleDomainDMARC)
 	authed.HandleFunc("POST /domains/{id}/export", h.HandleExportDomain)
 	authed.HandleFunc("POST /applications/{aid}/mode", h.HandleUpdateAppMode)
+	authed.HandleFunc("POST /applications/{aid}/authips", h.HandleAppAuthIPs)
 	authed.HandleFunc("POST /applications/{aid}/password", h.HandleRegenPassword)
 	authed.HandleFunc("POST /applications/{aid}/ratelimit", h.HandleAppRateLimit)
 	authed.HandleFunc("POST /applications/{aid}/ratelimit/recalc", h.HandleAppRateLimitRecalc)