release: 1.9.0

Application client IP allow-list restricts which addresses may submit as a SASL login; level-2 rate limits override the domain ceiling per application (higher or lower, capped at L1). Migration 0009, authips form, milter enforcement, export/import, and operator docs.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/web/handlers/handlers_apps.go

@@ -46,7 +46,7 @@ type detailView struct {
 type appRateLimitView struct {
 	store.Application
 	HasLimit       bool
-	IPsText        string
+	AuthIPsText    string
 	MaxText        string
 	WindowVal      string
 	Mode           string
@@ -116,7 +116,7 @@ func (h *Handlers) renderDomainDetail(w http.ResponseWriter, r *http.Request, st
 		appViews = append(appViews, appRateLimitView{
 			Application:    a,
 			HasLimit:       ok && rl.Active(),
-			IPsText:        strings.Join(rl.AllowedIPs, "\n"),
+			AuthIPsText:    strings.Join(a.AuthAllowedIPs, "\n"),
 			MaxText:        intOrBlank(rl.MaxMessages),
 			WindowVal:      windowOrDefault(rl.WindowSeconds),
 			Mode:           mode,
@@ -332,6 +332,8 @@ func detailFlash(r *http.Request) string {
 		return "Application address mode updated."
 	case r.URL.Query().Get("ratelimit") != "":
 		return "Rate limit updated."
+	case r.URL.Query().Get("authips") != "":
+		return "Client IP restriction updated."
 	case r.URL.Query().Get("recalculated") != "":
 		return "Auto rate limit recalculated."
 	case r.URL.Query().Get("dmarc") != "":

internal/web/handlers/handlers_ratelimit.go

@@ -98,7 +98,7 @@ func parseDomainRateLimitForm(r *http.Request, l1Max int) (rateLimitInput, error
 	return rateLimitInput{mode: store.RateLimitModeManual, maxMessages: maxMessages, windowSeconds: windowSeconds}, nil
 }
 
-func parseAppRateLimitForm(r *http.Request, l1Max, domainMax int, domainActive bool) (rateLimitInput, error) {
+func parseAppRateLimitForm(r *http.Request, l1Max int) (rateLimitInput, error) {
 	if err := r.ParseForm(); err != nil {
 		return rateLimitInput{}, fmt.Errorf("invalid form submission")
 	}
@@ -110,20 +110,12 @@ func parseAppRateLimitForm(r *http.Request, l1Max, domainMax int, domainActive b
 		return rateLimitInput{}, err
 	}
 
-	ips, err := parseIPList(r.PostFormValue("allowed_ips"))
-	if err != nil {
-		return rateLimitInput{}, err
-	}
-	if len(ips) == 0 {
-		return rateLimitInput{}, fmt.Errorf("enter at least one trusted client IP for an application override")
-	}
-
 	if mode == store.RateLimitModeAuto {
 		mult, err := parseAutoMultiplier(r.PostFormValue("auto_multiplier"))
 		if err != nil {
 			return rateLimitInput{}, err
 		}
-		return rateLimitInput{mode: mode, ips: ips, autoMultiplier: mult}, nil
+		return rateLimitInput{mode: mode, autoMultiplier: mult}, nil
 	}
 
 	rawMax := strings.TrimSpace(r.PostFormValue("max_messages"))
@@ -137,14 +129,29 @@ func parseAppRateLimitForm(r *http.Request, l1Max, domainMax int, domainActive b
 	if maxMessages > l1Max {
 		return rateLimitInput{}, fmt.Errorf("message limit cannot exceed the level-1 backstop (%d)", l1Max)
 	}
-	if domainActive && maxMessages <= domainMax {
-		return rateLimitInput{}, fmt.Errorf("application override must be greater than the domain limit (%d)", domainMax)
-	}
 	windowSeconds, err := parsePositiveInt(r.PostFormValue("window_seconds"), defaultRateLimitWindowSeconds)
 	if err != nil || windowSeconds <= 0 {
 		return rateLimitInput{}, fmt.Errorf("enter a time window greater than zero seconds")
 	}
-	return rateLimitInput{mode: store.RateLimitModeManual, ips: ips, maxMessages: maxMessages, windowSeconds: windowSeconds}, nil
+	return rateLimitInput{mode: store.RateLimitModeManual, maxMessages: maxMessages, windowSeconds: windowSeconds}, nil
+}
+
+func parseAppAuthIPsForm(r *http.Request) (bool, []string, error) {
+	if err := r.ParseForm(); err != nil {
+		return false, nil, fmt.Errorf("invalid form submission")
+	}
+	restrict := r.PostFormValue("auth_ip_restrict") != ""
+	if !restrict {
+		return false, nil, nil
+	}
+	ips, err := parseIPList(r.PostFormValue("auth_allowed_ips"))
+	if err != nil {
+		return false, nil, err
+	}
+	if len(ips) == 0 {
+		return false, nil, fmt.Errorf("enter at least one client IP when the allow-list is enabled")
+	}
+	return true, ips, nil
 }
 
 func parseIPList(raw string) ([]string, error) {
@@ -206,14 +213,7 @@ func (h *Handlers) HandleAppRateLimit(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
 	}
-	domainRL, domainOK, err := h.domains.RateLimit(d.ID)
-	if err != nil {
-		logf("panel: domain %d: rate limit: %v", d.ID, err)
-		http.Error(w, "internal error", http.StatusInternalServerError)
-		return
-	}
-	domainActive := domainOK && domainRL.Active()
-	in, err := parseAppRateLimitForm(r, h.l1Messages(), domainRL.MaxMessages, domainActive)
+	in, err := parseAppRateLimitForm(r, h.l1Messages())
 	if err != nil {
 		h.renderDomainDetail(w, r, http.StatusBadRequest, d, detailView{
 			FormMode:     store.AddressModeWildcard,
@@ -229,6 +229,32 @@ func (h *Handlers) HandleAppRateLimit(w http.ResponseWriter, r *http.Request) {
 	http.Redirect(w, r, fmt.Sprintf("/domains/%d?ratelimit=1", a.DomainID), http.StatusSeeOther)
 }
 
+func (h *Handlers) HandleAppAuthIPs(w http.ResponseWriter, r *http.Request) {
+	a, ok := h.lookupApplication(w, r)
+	if !ok {
+		return
+	}
+	d, err := h.domains.Get(a.DomainID)
+	if err != nil {
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	restrict, ips, err := parseAppAuthIPsForm(r)
+	if err != nil {
+		h.renderDomainDetail(w, r, http.StatusBadRequest, d, detailView{
+			FormMode:     store.AddressModeWildcard,
+			RateLimitErr: fmt.Sprintf("%s: %s", a.Login, err.Error()),
+		})
+		return
+	}
+	if err := h.apps.UpdateAuthIPs(a.ID, restrict, ips); err != nil {
+		logf("panel: application %d: save auth IPs: %v", a.ID, err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	http.Redirect(w, r, fmt.Sprintf("/domains/%d?authips=1", a.DomainID), http.StatusSeeOther)
+}
+
 func (h *Handlers) HandleDomainRateLimitRecalc(w http.ResponseWriter, r *http.Request) {
 	d, ok := h.lookupDomain(w, r)
 	if !ok {
@@ -294,7 +320,6 @@ func (h *Handlers) applyAppRateLimit(in rateLimitInput, appID int64) error {
 	rl := store.RateLimit{
 		Scope:          store.RateLimitScopeApp,
 		RefID:          appID,
-		AllowedIPs:     in.ips,
 		Mode:           in.mode,
 		MaxMessages:    in.maxMessages,
 		WindowSeconds:  in.windowSeconds,

internal/web/handlers/handlers_ratelimit_test.go

@@ -50,52 +50,52 @@ func TestParseAppRateLimitForm(t *testing.T) {
 
 	in, err := parseAppRateLimitForm(form(url.Values{
 		"mode":           {"manual"},
-		"allowed_ips":    {"203.0.113.10"},
 		"max_messages":   {"80"},
 		"window_seconds": {"3600"},
-	}), 100, 40, true)
-	if err != nil || in.maxMessages != 80 || len(in.ips) != 1 {
-		t.Fatalf("valid app override = %+v err=%v", in, err)
+	}), 100)
+	if err != nil || in.maxMessages != 80 {
+		t.Fatalf("valid app limit = %+v err=%v", in, err)
+	}
+
+	in, err = parseAppRateLimitForm(form(url.Values{"max_messages": {""}}), 100)
+	if err != nil || !in.clear {
+		t.Fatalf("empty max should clear: %+v err=%v", in, err)
 	}
 
 	_, err = parseAppRateLimitForm(form(url.Values{
 		"mode":           {"manual"},
-		"max_messages":   {"80"},
-		"window_seconds": {"3600"},
-	}), 100, 40, true)
-	if err == nil || !strings.Contains(err.Error(), "trusted client IP") {
-		t.Fatalf("missing IPs want error, got %v", err)
-	}
-
-	_, err = parseAppRateLimitForm(form(url.Values{
-		"mode":           {"manual"},
-		"allowed_ips":    {"203.0.113.10"},
-		"max_messages":   {"40"},
-		"window_seconds": {"3600"},
-	}), 100, 40, true)
-	if err == nil || !strings.Contains(err.Error(), "greater than the domain") {
-		t.Fatalf("app <= domain want error, got %v", err)
-	}
-
-	_, err = parseAppRateLimitForm(form(url.Values{
-		"mode":           {"manual"},
-		"allowed_ips":    {"203.0.113.10"},
 		"max_messages":   {"150"},
 		"window_seconds": {"3600"},
-	}), 100, 0, false)
+	}), 100)
 	if err == nil || !strings.Contains(err.Error(), "level-1") {
 		t.Fatalf("over L1 want error, got %v", err)
 	}
+}
 
-	// No domain limit: any app ceiling ≤ L1 is fine.
-	in, err = parseAppRateLimitForm(form(url.Values{
-		"mode":           {"manual"},
-		"allowed_ips":    {"203.0.113.10"},
-		"max_messages":   {"50"},
-		"window_seconds": {"3600"},
-	}), 100, 0, false)
-	if err != nil || in.maxMessages != 50 {
-		t.Fatalf("app without domain = %+v err=%v", in, err)
+func TestParseAppAuthIPsForm(t *testing.T) {
+	t.Parallel()
+	form := func(vals url.Values) *http.Request {
+		r := httptest.NewRequest(http.MethodPost, "/", strings.NewReader(vals.Encode()))
+		r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		return r
+	}
+
+	restrict, ips, err := parseAppAuthIPsForm(form(url.Values{
+		"auth_ip_restrict": {"1"},
+		"auth_allowed_ips":   {"203.0.113.10"},
+	}))
+	if err != nil || !restrict || len(ips) != 1 {
+		t.Fatalf("enabled with IP = restrict=%v ips=%v err=%v", restrict, ips, err)
+	}
+
+	restrict, ips, err = parseAppAuthIPsForm(form(url.Values{}))
+	if err != nil || restrict || ips != nil {
+		t.Fatalf("disabled = restrict=%v ips=%v err=%v", restrict, ips, err)
+	}
+
+	_, _, err = parseAppAuthIPsForm(form(url.Values{"auth_ip_restrict": {"1"}}))
+	if err == nil || !strings.Contains(err.Error(), "at least one client IP") {
+		t.Fatalf("enabled without IPs want error, got %v", err)
 	}
 }