Phase 4: applications + SASL (sasldb2) + sender_login_maps

Adds application accounts bound to domains: a SASL login/password in
sasldb2, a per-application address mode (wildcard @domain or an explicit
list), and matching smtpd_sender_login_maps bindings — with create,
list, edit-mode, delete and password regeneration (spec 4.1, 5.1,
7.2.5-9). Generated passwords are shown exactly once and never stored in
plaintext (7.6.1).

- internal/store/applications.go: transactional CRUD; globally unique
  login; ListBindings (address->login) as the map source; logins-by-
  domain for pre-cascade SASL cleanup.
- internal/app: saslpasswd2 wrapper (password via stdin, login as a
  whitelisted argv element, no shell — 7.6.3); strong base64url password;
  address validation that enforces domain ownership before any config
  write (7.6.2); service orchestrating store + sasldb2 + map with full
  rollback on partial failure.
- internal/postfix: sender_login_maps regenerated as a pure function of
  the registry (many-to-one logins merged per address), atomic write,
  injection backstop (7.6.4).
- Postfix reload, corrected: `postfix start-fg` forks a separate master,
  so signalling the supervised process never reaches it. Reload now runs
  the canonical `postfix reload` via a one-shot supervisord program the
  unprivileged panel triggers over the group control socket. Verified in
  mail.log.
- domain.Service.Delete purges the domain's SASL accounts, then cascades,
  then rebuilds the sender map and reloads; manual reload now covers both
  OpenDKIM and Postfix.
- web: application management in the domain page, one-time credential
  shown inline; postfix joins the selfpost group and entrypoint normalises
  /data/sasl and /data/postfix (setgid, group-readable) with self-heal.

Verified on the dev server: gofmt/vet/test green, image builds, and a
container e2e covers the full application lifecycle, domain-delete
cascade, restart persistence, and a real postfix reload.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/app/service.go

@@ -0,0 +1,200 @@
+// Package app owns application accounts (spec 4.1, 5.1): the SASL credentials in
+// sasldb2, the per-application sender address mode, and the
+// smtpd_sender_login_maps bindings that tie each login to the addresses it may
+// send from. It keeps those three stores — the SQLite registry, sasldb2 and the
+// Postfix map — in agreement and drives the Postfix reload.
+package app
+
+import (
+	"codeberg.org/mix/selfpost/internal/postfix"
+	"codeberg.org/mix/selfpost/internal/store"
+)
+
+// SenderMaps is the slice of the Postfix manager the application service needs:
+// rebuilding the sender_login_maps from the current bindings and reloading.
+// *postfix.Postfix satisfies it; tests substitute a fake.
+type SenderMaps interface {
+	RebuildSenderLoginMaps(bindings []postfix.Binding) error
+}
+
+// Service coordinates application state across SQLite, sasldb2 and the Postfix
+// sender_login_maps. Web handlers validate raw input first; the Service performs
+// the domain-ownership checks that must not be skipped (spec 7.6.2) and keeps
+// the stores consistent.
+type Service struct {
+	store *store.Store
+	sasl  *SASLDB
+	pf    SenderMaps
+}
+
+// NewService builds the application service over the shared store, the sasldb2
+// manager and the Postfix manager.
+func NewService(st *store.Store, sasl *SASLDB, pf SenderMaps) *Service {
+	return &Service{store: st, sasl: sasl, pf: pf}
+}
+
+// List returns a domain's applications with their address lists (spec 7.2.6).
+func (s *Service) List(domainID int64) ([]store.Application, error) {
+	return s.store.ListApplicationsByDomain(domainID)
+}
+
+// Get returns one application by id (store.ErrApplicationNotFound if absent).
+func (s *Service) Get(id int64) (store.Application, error) {
+	return s.store.GetApplication(id)
+}
+
+// Create adds an application to a domain: it validates the login and (in list
+// mode) that every address belongs to the domain (spec 7.6.2), generates a
+// strong password, writes the SASL account and rebuilds the sender map (spec
+// 7.2.5). The generated password is returned so the caller can show it exactly
+// once (spec 7.6.1) — it is never persisted in plaintext.
+//
+// The registry row is written first so its UNIQUE constraint is the sole arbiter
+// of a duplicate login (avoiding a check-then-act race and, crucially, avoiding
+// clobbering an existing account's password in sasldb2). If the SASL write or
+// the map rebuild fails, everything is rolled back so we never leave an
+// application the panel cannot fully account for.
+func (s *Service) Create(domainID int64, login, mode string, rawAddresses []string) (store.Application, string, error) {
+	addresses, err := s.validateForDomain(domainID, login, mode, rawAddresses)
+	if err != nil {
+		return store.Application{}, "", err
+	}
+
+	password, err := generatePassword()
+	if err != nil {
+		return store.Application{}, "", err
+	}
+
+	a, err := s.store.AddApplication(domainID, login, mode, addresses)
+	if err != nil {
+		return store.Application{}, "", err
+	}
+
+	if err := s.sasl.Set(login, password); err != nil {
+		s.rollbackCreate(a.ID, "") // login has no SASL account yet; nothing to unset
+		return store.Application{}, "", err
+	}
+	if err := s.Resync(); err != nil {
+		s.rollbackCreate(a.ID, login)
+		return store.Application{}, "", err
+	}
+	return a, password, nil
+}
+
+// rollbackCreate best-effort undoes a partially created application after a
+// downstream failure: it removes the SASL account (if one was written) and the
+// registry row. Errors here are subordinate to the original failure the caller
+// returns.
+func (s *Service) rollbackCreate(id int64, login string) {
+	if login != "" {
+		_ = s.sasl.Delete(login)
+	}
+	_, _ = s.store.DeleteApplication(id)
+}
+
+// UpdateMode switches an application's address mode / list and rebuilds the
+// sender map (spec 7.2.7). The login and password are untouched. Addresses are
+// re-validated against the application's domain.
+func (s *Service) UpdateMode(id int64, mode string, rawAddresses []string) error {
+	a, err := s.store.GetApplication(id)
+	if err != nil {
+		return err
+	}
+	addresses, err := s.validateForDomain(a.DomainID, a.Login, mode, rawAddresses)
+	if err != nil {
+		return err
+	}
+	if err := s.store.UpdateApplicationMode(id, mode, addresses); err != nil {
+		return err
+	}
+	return s.Resync()
+}
+
+// RegeneratePassword issues a fresh password for an existing application (spec
+// 7.2.9). The old password is invalidated by overwriting the SASL account; the
+// address mode and bindings are unchanged, so no map rebuild is needed. The new
+// password is returned to be shown once.
+func (s *Service) RegeneratePassword(id int64) (string, error) {
+	a, err := s.store.GetApplication(id)
+	if err != nil {
+		return "", err
+	}
+	password, err := generatePassword()
+	if err != nil {
+		return "", err
+	}
+	if err := s.sasl.Set(a.Login, password); err != nil {
+		return "", err
+	}
+	return password, nil
+}
+
+// Delete removes an application: its SASL account, its registry row (and address
+// rows via cascade) and its sender-map bindings, then reloads Postfix (spec
+// 7.2.8). The domain and other applications are untouched.
+func (s *Service) Delete(id int64) error {
+	a, err := s.store.DeleteApplication(id)
+	if err != nil {
+		return err
+	}
+	if err := s.sasl.Delete(a.Login); err != nil {
+		return err
+	}
+	return s.Resync()
+}
+
+// PurgeDomainSASL removes the SASL accounts of every application bound to a
+// domain. It must be called before the domain's registry rows are cascade-
+// deleted, while the logins are still known (spec 7.2.4). The registry rows and
+// the sender map are handled by the domain deletion path; this only clears
+// sasldb2, which has no cascade of its own.
+func (s *Service) PurgeDomainSASL(domainID int64) error {
+	logins, err := s.store.ListLoginsByDomain(domainID)
+	if err != nil {
+		return err
+	}
+	for _, login := range logins {
+		if err := s.sasl.Delete(login); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// Resync rebuilds smtpd_sender_login_maps from the full set of application
+// bindings and reloads Postfix (spec 5.1). It is the single idempotent apply
+// path shared by create/edit/delete and is also reachable from the manual
+// reload button; it doubles as recovery if the map ever drifts from the
+// database.
+func (s *Service) Resync() error {
+	bindings, err := s.store.ListBindings()
+	if err != nil {
+		return err
+	}
+	pfBindings := make([]postfix.Binding, 0, len(bindings))
+	for _, b := range bindings {
+		pfBindings = append(pfBindings, postfix.Binding{Address: b.Address, Login: b.Login})
+	}
+	return s.pf.RebuildSenderLoginMaps(pfBindings)
+}
+
+// validateForDomain resolves the domain, validates the login and address mode,
+// and — in list mode — validates that every address belongs to the domain
+// (spec 7.6.2). It returns the cleaned address list, which is empty in wildcard
+// mode. Resolving the domain here also confirms it exists before any write.
+func (s *Service) validateForDomain(domainID int64, login, mode string, rawAddresses []string) ([]string, error) {
+	d, err := s.store.GetDomain(domainID)
+	if err != nil {
+		return nil, err
+	}
+	if err := validateLogin(login); err != nil {
+		return nil, err
+	}
+	if err := validateAddressMode(mode); err != nil {
+		return nil, err
+	}
+	if mode == store.AddressModeWildcard {
+		return nil, nil
+	}
+	return parseAddresses(rawAddresses, d.Name)
+}