mix/selfpost
1
0
Fork 0
Code Issues Pull Requests Actions 21 Packages Projects Releases Wiki Activity

panel-redesign: the application form is one POST, under its domain

Browse Source 
Stage 1, step 4 (plan § Routes).

Service (internal/app)
  - Settings{Mode, Addresses, AuthIPRestrict, AuthAllowedIPs, Limit} is what
    the form holds besides the login. CreateWithSettings creates the
    application with all of it and removes it again if a later write fails;
    SaveSettings validates the sender rule first and, if a later write
    fails, puts back what it had already changed. The form produces a whole
    application or leaves things as they were.
  - Limit.Mode "" is "use the domain limit"; auto takes its ceiling from a
    recalculation the caller supplies.

Routes and handlers
  - GET, POST /outbound/domains/{id}/applications/new
    GET, POST /outbound/domains/{id}/applications/{aid}
    POST .../{aid}/password, .../{aid}/ratelimit/recalc, .../{aid}/delete
    replace POST /domains/{id}/applications and the six /applications/{aid}/*
    routes. lookupDomainApplication answers 404 when the application is not
    in the domain named by the path - also when the caller may open that
    domain.
  - A generated password is the response to its POST only (no GET path) and
    is sent with Cache-Control: no-store.
  - The login is not renamed by the form; a changed login is a 400.

Old domain page: the three per-application forms (mode, IP restriction,
limit) are one form with one Save; "Remove limit" became the "Use the domain
limit" choice. The e2e client follows (edited, not run here).

Tests: service - create and save in every limit mode, and all-or-nothing on
a refused sender rule, a failed recalculation and a failed sender-map
rebuild; handlers - the form's parsing, one POST creating sender + IPs +
limit, four kinds of refused form creating nothing, save, the no-store
header on both password pages, and five application routes against another
tenant's application addressed through its own domain and through the
caller's.

With @routes removed by hand TestRoutesFollowNavigation now reports only
GET /server/health (step 5).

go test ./...  green except the two Windows-only failures in internal/domain
and internal/logtail.

Roadmap 14/27.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
mix
2026-10-09 22:02:26 +03:00
co-authored by Claude Opus 5.5
parent bd746c61d7
commit b6feac2200
15 changed files with 792 additions and 157 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/app/service_test.go
+172
View File
@@ -318,3 +318,175 @@ func TestServicePurgeDomainSASL(t *testing.T) {
t.Errorf("deleted %d logins, want 2", len(rec.deleted))
}
}
// The application form is one POST: sender, client IPs and rate limit arrive
// together and are saved together.
func TestCreateWithSettings(t *testing.T) {
svc, st, rec, _ := newServiceHarness(t)
d := addDomain(t, st, "example.com")
recalced := 0
a, pw, err := svc.CreateWithSettings(d.ID, "prod", Settings{
Mode: store.AddressModeList, Addresses: []string{"alerts@example.com"},
AuthIPRestrict: true, AuthAllowedIPs: []string{"203.0.113.10"},
Limit: Limit{Mode: store.RateLimitModeManual, MaxMessages: 200, WindowSeconds: 3600},
}, func(int64) error { recalced++; return nil })
if err != nil {
t.Fatalf("CreateWithSettings: %v", err)
}
if rec.set["prod"] != pw || pw == "" {
t.Errorf("sasl password %q != returned %q", rec.set["prod"], pw)
}
if a.AddressMode != store.AddressModeList || len(a.Addresses) != 1 || !a.AuthIPRestrict || len(a.AuthAllowedIPs) != 1 {
t.Errorf("application = %+v", a)
}
rl, ok, err := svc.RateLimit(a.ID)
if err != nil || !ok || rl.MaxMessages != 200 || rl.WindowSeconds != 3600 || rl.IsAuto() {
t.Errorf("rate limit = %+v, %v, %v", rl, ok, err)
}
if recalced != 0 {
t.Error("a manual limit was recalculated")
}
// Auto: the ceiling comes from the caller's recalculation.
b, _, err := svc.CreateWithSettings(d.ID, "auto", Settings{
Mode: store.AddressModeWildcard, Limit: Limit{Mode: store.RateLimitModeAuto, AutoMultiplier: 2.5, WindowSeconds: 3600},
}, func(int64) error { recalced++; return nil })
if err != nil {
t.Fatalf("CreateWithSettings auto: %v", err)
}
if rl, ok, _ := svc.RateLimit(b.ID); !ok || !rl.IsAuto() || rl.AutoMultiplier != 2.5 || recalced != 1 {
t.Errorf("auto limit = %+v, %v; recalculated %d time(s)", rl, ok, recalced)
}
// No limit of its own: the domain limit applies.
c, _, err := svc.CreateWithSettings(d.ID, "plain", Settings{Mode: store.AddressModeWildcard}, nil)
if err != nil {
t.Fatalf("CreateWithSettings plain: %v", err)
}
if _, ok, _ := svc.RateLimit(c.ID); ok {
t.Error("an application created without a limit has one")
}
}
// A failure after the application row exists must leave no application: not in
// the registry, not in sasldb2, and no orphaned limit.
func TestCreateWithSettingsIsAllOrNothing(t *testing.T) {
svc, st, rec, _ := newServiceHarness(t)
d := addDomain(t, st, "example.com")
_, _, err := svc.CreateWithSettings(d.ID, "prod", Settings{
Mode: store.AddressModeWildcard, AuthIPRestrict: true, AuthAllowedIPs: []string{"203.0.113.10"},
Limit: Limit{Mode: store.RateLimitModeAuto, AutoMultiplier: 2, WindowSeconds: 3600},
}, func(int64) error { return errors.New("no statistics") })
if err == nil {
t.Fatal("CreateWithSettings succeeded although the recalculation failed")
}
if apps, _ := st.ListApplicationsByDomain(d.ID); len(apps) != 0 {
t.Errorf("%d application(s) left behind", len(apps))
}
if _, ok := rec.set["prod"]; ok {
t.Error("the SASL account was left behind")
}
// The id is free again and carries nothing over.
a, _, err := svc.CreateWithSettings(d.ID, "prod", Settings{Mode: store.AddressModeWildcard}, nil)
if err != nil {
t.Fatalf("create again: %v", err)
}
if _, ok, _ := svc.RateLimit(a.ID); ok || a.AuthIPRestrict {
t.Errorf("the new application inherited settings of the failed one: %+v", a)
}
// A sender rule that does not validate creates nothing either.
if _, _, err := svc.CreateWithSettings(d.ID, "bad", Settings{Mode: store.AddressModeList, Addresses: []string{"a@evil.com"}}, nil); err == nil {
t.Error("a cross-domain address was accepted")
}
if _, ok := rec.set["bad"]; ok {
t.Error("a SASL account was written for a refused application")
}
}
func TestSaveSettings(t *testing.T) {
svc, st, rec, maps := newServiceHarness(t)
d := addDomain(t, st, "example.com")
a, pw, err := svc.CreateWithSettings(d.ID, "prod", Settings{
Mode: store.AddressModeWildcard, Limit: Limit{Mode: store.RateLimitModeManual, MaxMessages: 100, WindowSeconds: 3600},
}, nil)
if err != nil {
t.Fatalf("create: %v", err)
}
err = svc.SaveSettings(a.ID, Settings{
Mode: store.AddressModeList, Addresses: []string{"alerts@example.com", "noreply@example.com"},
AuthIPRestrict: true, AuthAllowedIPs: []string{"203.0.113.10", "203.0.113.11"},
}, nil)
if err != nil {
t.Fatalf("SaveSettings: %v", err)
}
got, _ := st.GetApplication(a.ID)
if got.AddressMode != store.AddressModeList || len(got.Addresses) != 2 || !got.AuthIPRestrict || len(got.AuthAllowedIPs) != 2 {
t.Errorf("application = %+v", got)
}
if _, ok, _ := svc.RateLimit(a.ID); ok {
t.Error("choosing the domain limit left the application's own limit in place")
}
if len(maps.last) != 2 {
t.Errorf("sender map has %d binding(s), want the two listed addresses", len(maps.last))
}
if rec.set["prod"] != pw {
t.Error("saving the settings touched the password")
}
}
// Nothing is half-saved: a sender rule that does not validate changes nothing,
// and a failure in a later write puts the earlier ones back.
func TestSaveSettingsIsAllOrNothing(t *testing.T) {
svc, st, _, maps := newServiceHarness(t)
d := addDomain(t, st, "example.com")
a, _, err := svc.CreateWithSettings(d.ID, "prod", Settings{
Mode: store.AddressModeList, Addresses: []string{"alerts@example.com"},
AuthIPRestrict: true, AuthAllowedIPs: []string{"203.0.113.10"},
Limit: Limit{Mode: store.RateLimitModeManual, MaxMessages: 100, WindowSeconds: 3600},
}, nil)
if err != nil {
t.Fatalf("create: %v", err)
}
unchanged := func(when string) {
t.Helper()
got, _ := st.GetApplication(a.ID)
rl, ok, _ := svc.RateLimit(a.ID)
if got.AddressMode != store.AddressModeList || len(got.Addresses) != 1 || got.Addresses[0] != "alerts@example.com" ||
!got.AuthIPRestrict || len(got.AuthAllowedIPs) != 1 || !ok || rl.MaxMessages != 100 || rl.IsAuto() {
t.Errorf("%s: the application changed: %+v, limit %+v (%v)", when, got, rl, ok)
}
}
change := Settings{
Mode: store.AddressModeWildcard, AuthIPRestrict: false,
Limit: Limit{Mode: store.RateLimitModeAuto, AutoMultiplier: 3, WindowSeconds: 3600},
}
bad := change
bad.Mode, bad.Addresses = store.AddressModeList, []string{"a@evil.com"}
if err := svc.SaveSettings(a.ID, bad, nil); err == nil {
t.Fatal("a cross-domain address was accepted")
}
unchanged("after a refused sender rule")
if err := svc.SaveSettings(a.ID, change, func(int64) error { return errors.New("no statistics") }); err == nil {
t.Fatal("SaveSettings succeeded although the recalculation failed")
}
unchanged("after a failed recalculation")
maps.failNext = true
if err := svc.SaveSettings(a.ID, change, func(int64) error { return nil }); err == nil {
t.Fatal("SaveSettings succeeded although the sender map could not be rebuilt")
}
unchanged("after a failed sender-map rebuild")
if len(maps.last) != 1 || maps.last[0].Address != "alerts@example.com" {
t.Errorf("the sender map was left at %+v", maps.last)
}
if err := svc.SaveSettings(a.ID+100, change, nil); !errors.Is(err, store.ErrApplicationNotFound) {
t.Errorf("unknown application = %v, want ErrApplicationNotFound", err)
}
}