panel-redesign: the application form is one POST, under its domain

Stage 1, step 4 (plan § Routes).

Service (internal/app)
  - Settings{Mode, Addresses, AuthIPRestrict, AuthAllowedIPs, Limit} is what
    the form holds besides the login. CreateWithSettings creates the
    application with all of it and removes it again if a later write fails;
    SaveSettings validates the sender rule first and, if a later write
    fails, puts back what it had already changed. The form produces a whole
    application or leaves things as they were.
  - Limit.Mode "" is "use the domain limit"; auto takes its ceiling from a
    recalculation the caller supplies.

Routes and handlers
  - GET, POST /outbound/domains/{id}/applications/new
    GET, POST /outbound/domains/{id}/applications/{aid}
    POST .../{aid}/password, .../{aid}/ratelimit/recalc, .../{aid}/delete
    replace POST /domains/{id}/applications and the six /applications/{aid}/*
    routes. lookupDomainApplication answers 404 when the application is not
    in the domain named by the path - also when the caller may open that
    domain.
  - A generated password is the response to its POST only (no GET path) and
    is sent with Cache-Control: no-store.
  - The login is not renamed by the form; a changed login is a 400.

Old domain page: the three per-application forms (mode, IP restriction,
limit) are one form with one Save; "Remove limit" became the "Use the domain
limit" choice. The e2e client follows (edited, not run here).

Tests: service - create and save in every limit mode, and all-or-nothing on
a refused sender rule, a failed recalculation and a failed sender-map
rebuild; handlers - the form's parsing, one POST creating sender + IPs +
limit, four kinds of refused form creating nothing, save, the no-store
header on both password pages, and five application routes against another
tenant's application addressed through its own domain and through the
caller's.

With @routes removed by hand TestRoutesFollowNavigation now reports only
GET /server/health (step 5).

go test ./...  green except the two Windows-only failures in internal/domain
and internal/logtail.

Roadmap 14/27.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/app/sasl.go

@@ -183,3 +183,11 @@ func dumpSASLDB(path string) ([]byte, error) {
 	}
 	return out, nil
 }
+
+// WithRunner replaces the command that runs saslpasswd2 and returns the same
+// manager. It exists for tests outside this package that need an application
+// service without the real binary; the panel never calls it.
+func (s *SASLDB) WithRunner(run func(args []string, stdin []byte) error) *SASLDB {
+	s.run = run
+	return s
+}

internal/app/service.go

@@ -275,3 +275,117 @@ func (s *Service) validateForDomain(domainID int64, login, mode string, rawAddre
 	}
 	return parseAddresses(rawAddresses, d.Name)
 }
+
+// Limit is an application's level-2 rate-limit choice on the application form.
+// An empty Mode means "use the domain limit": the application has no limit of
+// its own.
+type Limit struct {
+	Mode           string // "", store.RateLimitModeManual or store.RateLimitModeAuto
+	MaxMessages    int
+	WindowSeconds  int
+	AutoMultiplier float64
+}
+
+// Settings is everything the application form holds besides the login: who the
+// application may send as, which client IPs may use it, and its rate limit.
+// The form is one POST, so the three are validated and saved together.
+type Settings struct {
+	Mode           string
+	Addresses      []string // raw; list mode only
+	AuthIPRestrict bool
+	AuthAllowedIPs []string
+	Limit          Limit
+}
+
+// Recalc derives an auto limit's ceiling from send statistics. The numbers it
+// needs (retention, the level-1 backstop) are the panel's configuration, so
+// the caller supplies it.
+type Recalc func(appID int64) error
+
+// CreateWithSettings adds an application with all of its settings in one step
+// and returns the password to show once. If anything after the creation fails
+// the application is removed again: the form either produces a complete
+// application or none.
+func (s *Service) CreateWithSettings(domainID int64, login string, set Settings, recalc Recalc) (store.Application, string, error) {
+	a, password, err := s.Create(domainID, login, set.Mode, set.Addresses)
+	if err != nil {
+		return store.Application{}, "", err
+	}
+	if err := s.applyAccess(a.ID, set, recalc); err != nil {
+		_ = s.ClearRateLimit(a.ID)
+		s.rollbackCreate(a.ID, login)
+		_ = s.Resync()
+		return store.Application{}, "", err
+	}
+	a, err = s.store.GetApplication(a.ID)
+	if err != nil {
+		return store.Application{}, "", err
+	}
+	return a, password, nil
+}
+
+// SaveSettings replaces an application's settings in one step. The sender
+// rules are validated before anything is written; if a later write fails, what
+// was already changed is put back, so the application is left as it was rather
+// than half-saved. The login and the password are untouched.
+func (s *Service) SaveSettings(id int64, set Settings, recalc Recalc) error {
+	before, err := s.store.GetApplication(id)
+	if err != nil {
+		return err
+	}
+	addresses, err := s.validateForDomain(before.DomainID, before.Login, set.Mode, set.Addresses)
+	if err != nil {
+		return err
+	}
+	limitBefore, hadLimit, err := s.RateLimit(id)
+	if err != nil {
+		return err
+	}
+	restore := func() {
+		_ = s.store.UpdateApplicationMode(id, before.AddressMode, before.Addresses)
+		_ = s.store.UpdateApplicationAuthIPs(id, before.AuthIPRestrict, before.AuthAllowedIPs)
+		if hadLimit {
+			_ = s.SaveRateLimit(id, limitBefore)
+		} else {
+			_ = s.ClearRateLimit(id)
+		}
+		_ = s.Resync()
+	}
+	if err := s.store.UpdateApplicationMode(id, set.Mode, addresses); err != nil {
+		restore()
+		return err
+	}
+	if err := s.applyAccess(id, set, recalc); err != nil {
+		restore()
+		return err
+	}
+	if err := s.Resync(); err != nil {
+		restore()
+		return err
+	}
+	return nil
+}
+
+// applyAccess writes the client-IP restriction and the rate limit.
+func (s *Service) applyAccess(id int64, set Settings, recalc Recalc) error {
+	if err := s.UpdateAuthIPs(id, set.AuthIPRestrict, set.AuthAllowedIPs); err != nil {
+		return err
+	}
+	switch set.Limit.Mode {
+	case "":
+		return s.ClearRateLimit(id)
+	case store.RateLimitModeAuto:
+		rl := store.RateLimit{Mode: store.RateLimitModeAuto, AutoMultiplier: set.Limit.AutoMultiplier, WindowSeconds: set.Limit.WindowSeconds}
+		if err := s.SaveRateLimit(id, rl); err != nil {
+			return err
+		}
+		if recalc == nil {
+			return nil
+		}
+		return recalc(id)
+	default:
+		return s.SaveRateLimit(id, store.RateLimit{
+			Mode: store.RateLimitModeManual, MaxMessages: set.Limit.MaxMessages, WindowSeconds: set.Limit.WindowSeconds,
+		})
+	}
+}

internal/app/service_test.go

@@ -318,3 +318,175 @@ func TestServicePurgeDomainSASL(t *testing.T) {
 		t.Errorf("deleted %d logins, want 2", len(rec.deleted))
 	}
 }
+
+// The application form is one POST: sender, client IPs and rate limit arrive
+// together and are saved together.
+func TestCreateWithSettings(t *testing.T) {
+	svc, st, rec, _ := newServiceHarness(t)
+	d := addDomain(t, st, "example.com")
+	recalced := 0
+
+	a, pw, err := svc.CreateWithSettings(d.ID, "prod", Settings{
+		Mode: store.AddressModeList, Addresses: []string{"alerts@example.com"},
+		AuthIPRestrict: true, AuthAllowedIPs: []string{"203.0.113.10"},
+		Limit: Limit{Mode: store.RateLimitModeManual, MaxMessages: 200, WindowSeconds: 3600},
+	}, func(int64) error { recalced++; return nil })
+	if err != nil {
+		t.Fatalf("CreateWithSettings: %v", err)
+	}
+	if rec.set["prod"] != pw || pw == "" {
+		t.Errorf("sasl password %q != returned %q", rec.set["prod"], pw)
+	}
+	if a.AddressMode != store.AddressModeList || len(a.Addresses) != 1 || !a.AuthIPRestrict || len(a.AuthAllowedIPs) != 1 {
+		t.Errorf("application = %+v", a)
+	}
+	rl, ok, err := svc.RateLimit(a.ID)
+	if err != nil || !ok || rl.MaxMessages != 200 || rl.WindowSeconds != 3600 || rl.IsAuto() {
+		t.Errorf("rate limit = %+v, %v, %v", rl, ok, err)
+	}
+	if recalced != 0 {
+		t.Error("a manual limit was recalculated")
+	}
+
+	// Auto: the ceiling comes from the caller's recalculation.
+	b, _, err := svc.CreateWithSettings(d.ID, "auto", Settings{
+		Mode: store.AddressModeWildcard, Limit: Limit{Mode: store.RateLimitModeAuto, AutoMultiplier: 2.5, WindowSeconds: 3600},
+	}, func(int64) error { recalced++; return nil })
+	if err != nil {
+		t.Fatalf("CreateWithSettings auto: %v", err)
+	}
+	if rl, ok, _ := svc.RateLimit(b.ID); !ok || !rl.IsAuto() || rl.AutoMultiplier != 2.5 || recalced != 1 {
+		t.Errorf("auto limit = %+v, %v; recalculated %d time(s)", rl, ok, recalced)
+	}
+
+	// No limit of its own: the domain limit applies.
+	c, _, err := svc.CreateWithSettings(d.ID, "plain", Settings{Mode: store.AddressModeWildcard}, nil)
+	if err != nil {
+		t.Fatalf("CreateWithSettings plain: %v", err)
+	}
+	if _, ok, _ := svc.RateLimit(c.ID); ok {
+		t.Error("an application created without a limit has one")
+	}
+}
+
+// A failure after the application row exists must leave no application: not in
+// the registry, not in sasldb2, and no orphaned limit.
+func TestCreateWithSettingsIsAllOrNothing(t *testing.T) {
+	svc, st, rec, _ := newServiceHarness(t)
+	d := addDomain(t, st, "example.com")
+
+	_, _, err := svc.CreateWithSettings(d.ID, "prod", Settings{
+		Mode: store.AddressModeWildcard, AuthIPRestrict: true, AuthAllowedIPs: []string{"203.0.113.10"},
+		Limit: Limit{Mode: store.RateLimitModeAuto, AutoMultiplier: 2, WindowSeconds: 3600},
+	}, func(int64) error { return errors.New("no statistics") })
+	if err == nil {
+		t.Fatal("CreateWithSettings succeeded although the recalculation failed")
+	}
+	if apps, _ := st.ListApplicationsByDomain(d.ID); len(apps) != 0 {
+		t.Errorf("%d application(s) left behind", len(apps))
+	}
+	if _, ok := rec.set["prod"]; ok {
+		t.Error("the SASL account was left behind")
+	}
+	// The id is free again and carries nothing over.
+	a, _, err := svc.CreateWithSettings(d.ID, "prod", Settings{Mode: store.AddressModeWildcard}, nil)
+	if err != nil {
+		t.Fatalf("create again: %v", err)
+	}
+	if _, ok, _ := svc.RateLimit(a.ID); ok || a.AuthIPRestrict {
+		t.Errorf("the new application inherited settings of the failed one: %+v", a)
+	}
+
+	// A sender rule that does not validate creates nothing either.
+	if _, _, err := svc.CreateWithSettings(d.ID, "bad", Settings{Mode: store.AddressModeList, Addresses: []string{"a@evil.com"}}, nil); err == nil {
+		t.Error("a cross-domain address was accepted")
+	}
+	if _, ok := rec.set["bad"]; ok {
+		t.Error("a SASL account was written for a refused application")
+	}
+}
+
+func TestSaveSettings(t *testing.T) {
+	svc, st, rec, maps := newServiceHarness(t)
+	d := addDomain(t, st, "example.com")
+	a, pw, err := svc.CreateWithSettings(d.ID, "prod", Settings{
+		Mode: store.AddressModeWildcard, Limit: Limit{Mode: store.RateLimitModeManual, MaxMessages: 100, WindowSeconds: 3600},
+	}, nil)
+	if err != nil {
+		t.Fatalf("create: %v", err)
+	}
+
+	err = svc.SaveSettings(a.ID, Settings{
+		Mode: store.AddressModeList, Addresses: []string{"alerts@example.com", "noreply@example.com"},
+		AuthIPRestrict: true, AuthAllowedIPs: []string{"203.0.113.10", "203.0.113.11"},
+	}, nil)
+	if err != nil {
+		t.Fatalf("SaveSettings: %v", err)
+	}
+	got, _ := st.GetApplication(a.ID)
+	if got.AddressMode != store.AddressModeList || len(got.Addresses) != 2 || !got.AuthIPRestrict || len(got.AuthAllowedIPs) != 2 {
+		t.Errorf("application = %+v", got)
+	}
+	if _, ok, _ := svc.RateLimit(a.ID); ok {
+		t.Error("choosing the domain limit left the application's own limit in place")
+	}
+	if len(maps.last) != 2 {
+		t.Errorf("sender map has %d binding(s), want the two listed addresses", len(maps.last))
+	}
+	if rec.set["prod"] != pw {
+		t.Error("saving the settings touched the password")
+	}
+}
+
+// Nothing is half-saved: a sender rule that does not validate changes nothing,
+// and a failure in a later write puts the earlier ones back.
+func TestSaveSettingsIsAllOrNothing(t *testing.T) {
+	svc, st, _, maps := newServiceHarness(t)
+	d := addDomain(t, st, "example.com")
+	a, _, err := svc.CreateWithSettings(d.ID, "prod", Settings{
+		Mode: store.AddressModeList, Addresses: []string{"alerts@example.com"},
+		AuthIPRestrict: true, AuthAllowedIPs: []string{"203.0.113.10"},
+		Limit: Limit{Mode: store.RateLimitModeManual, MaxMessages: 100, WindowSeconds: 3600},
+	}, nil)
+	if err != nil {
+		t.Fatalf("create: %v", err)
+	}
+	unchanged := func(when string) {
+		t.Helper()
+		got, _ := st.GetApplication(a.ID)
+		rl, ok, _ := svc.RateLimit(a.ID)
+		if got.AddressMode != store.AddressModeList || len(got.Addresses) != 1 || got.Addresses[0] != "alerts@example.com" ||
+			!got.AuthIPRestrict || len(got.AuthAllowedIPs) != 1 || !ok || rl.MaxMessages != 100 || rl.IsAuto() {
+			t.Errorf("%s: the application changed: %+v, limit %+v (%v)", when, got, rl, ok)
+		}
+	}
+
+	change := Settings{
+		Mode: store.AddressModeWildcard, AuthIPRestrict: false,
+		Limit: Limit{Mode: store.RateLimitModeAuto, AutoMultiplier: 3, WindowSeconds: 3600},
+	}
+	bad := change
+	bad.Mode, bad.Addresses = store.AddressModeList, []string{"a@evil.com"}
+	if err := svc.SaveSettings(a.ID, bad, nil); err == nil {
+		t.Fatal("a cross-domain address was accepted")
+	}
+	unchanged("after a refused sender rule")
+
+	if err := svc.SaveSettings(a.ID, change, func(int64) error { return errors.New("no statistics") }); err == nil {
+		t.Fatal("SaveSettings succeeded although the recalculation failed")
+	}
+	unchanged("after a failed recalculation")
+
+	maps.failNext = true
+	if err := svc.SaveSettings(a.ID, change, func(int64) error { return nil }); err == nil {
+		t.Fatal("SaveSettings succeeded although the sender map could not be rebuilt")
+	}
+	unchanged("after a failed sender-map rebuild")
+	if len(maps.last) != 1 || maps.last[0].Address != "alerts@example.com" {
+		t.Errorf("the sender map was left at %+v", maps.last)
+	}
+
+	if err := svc.SaveSettings(a.ID+100, change, nil); !errors.Is(err, store.ErrApplicationNotFound) {
+		t.Errorf("unknown application = %v, want ErrApplicationNotFound", err)
+	}
+}