Phase 4: applications + SASL (sasldb2) + sender_login_maps
Adds application accounts bound to domains: a SASL login/password in sasldb2, a per-application address mode (wildcard @domain or an explicit list), and matching smtpd_sender_login_maps bindings — with create, list, edit-mode, delete and password regeneration (spec 4.1, 5.1, 7.2.5-9). Generated passwords are shown exactly once and never stored in plaintext (7.6.1). - internal/store/applications.go: transactional CRUD; globally unique login; ListBindings (address->login) as the map source; logins-by- domain for pre-cascade SASL cleanup. - internal/app: saslpasswd2 wrapper (password via stdin, login as a whitelisted argv element, no shell — 7.6.3); strong base64url password; address validation that enforces domain ownership before any config write (7.6.2); service orchestrating store + sasldb2 + map with full rollback on partial failure. - internal/postfix: sender_login_maps regenerated as a pure function of the registry (many-to-one logins merged per address), atomic write, injection backstop (7.6.4). - Postfix reload, corrected: `postfix start-fg` forks a separate master, so signalling the supervised process never reaches it. Reload now runs the canonical `postfix reload` via a one-shot supervisord program the unprivileged panel triggers over the group control socket. Verified in mail.log. - domain.Service.Delete purges the domain's SASL accounts, then cascades, then rebuilds the sender map and reloads; manual reload now covers both OpenDKIM and Postfix. - web: application management in the domain page, one-time credential shown inline; postfix joins the selfpost group and entrypoint normalises /data/sasl and /data/postfix (setgid, group-readable) with self-heal. Verified on the dev server: gofmt/vet/test green, image builds, and a container e2e covers the full application lifecycle, domain-delete cascade, restart persistence, and a real postfix reload. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
@@ -0,0 +1,243 @@
|
||||
package app
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
|
||||
"codeberg.org/mix/selfpost/internal/postfix"
|
||||
"codeberg.org/mix/selfpost/internal/store"
|
||||
)
|
||||
|
||||
// fakeMaps records the last set of bindings passed to a rebuild and can be told
|
||||
// to fail, so we can exercise the rollback paths.
|
||||
type fakeMaps struct {
|
||||
last []postfix.Binding
|
||||
calls int
|
||||
failNext bool
|
||||
}
|
||||
|
||||
func (f *fakeMaps) RebuildSenderLoginMaps(b []postfix.Binding) error {
|
||||
f.calls++
|
||||
if f.failNext {
|
||||
f.failNext = false
|
||||
return errors.New("boom")
|
||||
}
|
||||
f.last = b
|
||||
return nil
|
||||
}
|
||||
|
||||
// saslRecorder is a fake sasldb2 backend recording set/delete calls.
|
||||
type saslRecorder struct {
|
||||
set map[string]string // login -> password
|
||||
deleted []string
|
||||
failNext bool
|
||||
}
|
||||
|
||||
func newServiceHarness(t *testing.T) (*Service, *store.Store, *saslRecorder, *fakeMaps) {
|
||||
t.Helper()
|
||||
st, err := store.Open(filepath.Join(t.TempDir(), "test.db"))
|
||||
if err != nil {
|
||||
t.Fatalf("open store: %v", err)
|
||||
}
|
||||
t.Cleanup(func() { st.Close() })
|
||||
|
||||
rec := &saslRecorder{set: map[string]string{}}
|
||||
sasl := NewSASLDB("/data/sasl/sasldb2", "mail.example.com")
|
||||
sasl.run = func(args []string, stdin []byte) error {
|
||||
if rec.failNext {
|
||||
rec.failNext = false
|
||||
return errors.New("saslpasswd2 failed")
|
||||
}
|
||||
// args end with the login; a "-d" anywhere means delete.
|
||||
login := args[len(args)-1]
|
||||
del := false
|
||||
for _, a := range args {
|
||||
if a == "-d" {
|
||||
del = true
|
||||
}
|
||||
}
|
||||
if del {
|
||||
rec.deleted = append(rec.deleted, login)
|
||||
delete(rec.set, login)
|
||||
} else {
|
||||
rec.set[login] = string(stdin)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
maps := &fakeMaps{}
|
||||
return NewService(st, sasl, maps), st, rec, maps
|
||||
}
|
||||
|
||||
func addDomain(t *testing.T, st *store.Store, name string) store.Domain {
|
||||
t.Helper()
|
||||
d, err := st.AddDomain(name, "selfpost")
|
||||
if err != nil {
|
||||
t.Fatalf("AddDomain: %v", err)
|
||||
}
|
||||
return d
|
||||
}
|
||||
|
||||
func TestServiceCreateWildcard(t *testing.T) {
|
||||
svc, st, rec, maps := newServiceHarness(t)
|
||||
d := addDomain(t, st, "example.com")
|
||||
|
||||
a, pw, err := svc.Create(d.ID, "alerts", store.AddressModeWildcard, nil)
|
||||
if err != nil {
|
||||
t.Fatalf("Create: %v", err)
|
||||
}
|
||||
if a.Login != "alerts" {
|
||||
t.Errorf("login = %q", a.Login)
|
||||
}
|
||||
if rec.set["alerts"] != pw {
|
||||
t.Errorf("sasl password %q != returned %q", rec.set["alerts"], pw)
|
||||
}
|
||||
if len(maps.last) != 1 || maps.last[0].Address != "@example.com" || maps.last[0].Login != "alerts" {
|
||||
t.Errorf("map bindings = %+v", maps.last)
|
||||
}
|
||||
}
|
||||
|
||||
func TestServiceCreateListValidatesDomain(t *testing.T) {
|
||||
svc, st, _, _ := newServiceHarness(t)
|
||||
d := addDomain(t, st, "example.com")
|
||||
|
||||
// A cross-domain address is rejected before anything is written.
|
||||
_, _, err := svc.Create(d.ID, "app1", store.AddressModeList, []string{"a@evil.com"})
|
||||
if err == nil {
|
||||
t.Fatal("Create accepted cross-domain address")
|
||||
}
|
||||
apps, _ := st.ListApplicationsByDomain(d.ID)
|
||||
if len(apps) != 0 {
|
||||
t.Errorf("application persisted despite validation failure: %+v", apps)
|
||||
}
|
||||
}
|
||||
|
||||
func TestServiceCreateDuplicateLogin(t *testing.T) {
|
||||
svc, st, _, _ := newServiceHarness(t)
|
||||
d := addDomain(t, st, "example.com")
|
||||
if _, _, err := svc.Create(d.ID, "dup", store.AddressModeWildcard, nil); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
_, _, err := svc.Create(d.ID, "dup", store.AddressModeWildcard, nil)
|
||||
if !errors.Is(err, store.ErrLoginExists) {
|
||||
t.Fatalf("duplicate create = %v, want ErrLoginExists", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestServiceCreateRollsBackOnSASLFailure(t *testing.T) {
|
||||
svc, st, rec, _ := newServiceHarness(t)
|
||||
d := addDomain(t, st, "example.com")
|
||||
|
||||
rec.failNext = true // saslpasswd2 fails on the first (set) call
|
||||
_, _, err := svc.Create(d.ID, "app1", store.AddressModeWildcard, nil)
|
||||
if err == nil {
|
||||
t.Fatal("expected Create to fail when SASL set fails")
|
||||
}
|
||||
apps, _ := st.ListApplicationsByDomain(d.ID)
|
||||
if len(apps) != 0 {
|
||||
t.Errorf("registry row not rolled back: %+v", apps)
|
||||
}
|
||||
}
|
||||
|
||||
func TestServiceCreateRollsBackOnMapFailure(t *testing.T) {
|
||||
svc, st, rec, maps := newServiceHarness(t)
|
||||
d := addDomain(t, st, "example.com")
|
||||
|
||||
maps.failNext = true
|
||||
_, _, err := svc.Create(d.ID, "app1", store.AddressModeWildcard, nil)
|
||||
if err == nil {
|
||||
t.Fatal("expected Create to fail when map rebuild fails")
|
||||
}
|
||||
apps, _ := st.ListApplicationsByDomain(d.ID)
|
||||
if len(apps) != 0 {
|
||||
t.Errorf("registry row not rolled back: %+v", apps)
|
||||
}
|
||||
if _, ok := rec.set["app1"]; ok {
|
||||
t.Errorf("SASL account not rolled back")
|
||||
}
|
||||
}
|
||||
|
||||
func TestServiceDelete(t *testing.T) {
|
||||
svc, st, rec, _ := newServiceHarness(t)
|
||||
d := addDomain(t, st, "example.com")
|
||||
a, _, err := svc.Create(d.ID, "app1", store.AddressModeWildcard, nil)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
if err := svc.Delete(a.ID); err != nil {
|
||||
t.Fatalf("Delete: %v", err)
|
||||
}
|
||||
if _, ok := rec.set["app1"]; ok {
|
||||
t.Error("SASL account not deleted")
|
||||
}
|
||||
if len(rec.deleted) != 1 || rec.deleted[0] != "app1" {
|
||||
t.Errorf("deleted logins = %v", rec.deleted)
|
||||
}
|
||||
apps, _ := st.ListApplicationsByDomain(d.ID)
|
||||
if len(apps) != 0 {
|
||||
t.Errorf("application not deleted: %+v", apps)
|
||||
}
|
||||
}
|
||||
|
||||
func TestServiceUpdateMode(t *testing.T) {
|
||||
svc, st, _, maps := newServiceHarness(t)
|
||||
d := addDomain(t, st, "example.com")
|
||||
a, _, err := svc.Create(d.ID, "app1", store.AddressModeWildcard, nil)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
if err := svc.UpdateMode(a.ID, store.AddressModeList, []string{"alerts@example.com"}); err != nil {
|
||||
t.Fatalf("UpdateMode: %v", err)
|
||||
}
|
||||
if len(maps.last) != 1 || maps.last[0].Address != "alerts@example.com" {
|
||||
t.Errorf("map after mode switch = %+v", maps.last)
|
||||
}
|
||||
got, _ := st.GetApplication(a.ID)
|
||||
if got.AddressMode != store.AddressModeList || len(got.Addresses) != 1 {
|
||||
t.Errorf("stored app after switch = %+v", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestServiceRegeneratePassword(t *testing.T) {
|
||||
svc, st, rec, _ := newServiceHarness(t)
|
||||
d := addDomain(t, st, "example.com")
|
||||
a, pw1, err := svc.Create(d.ID, "app1", store.AddressModeWildcard, nil)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
pw2, err := svc.RegeneratePassword(a.ID)
|
||||
if err != nil {
|
||||
t.Fatalf("RegeneratePassword: %v", err)
|
||||
}
|
||||
if pw1 == pw2 {
|
||||
t.Error("regenerated password equals the old one")
|
||||
}
|
||||
if rec.set["app1"] != pw2 {
|
||||
t.Errorf("sasl password not updated to new value")
|
||||
}
|
||||
}
|
||||
|
||||
func TestServicePurgeDomainSASL(t *testing.T) {
|
||||
svc, st, rec, _ := newServiceHarness(t)
|
||||
d := addDomain(t, st, "example.com")
|
||||
if _, _, err := svc.Create(d.ID, "app-a", store.AddressModeWildcard, nil); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if _, _, err := svc.Create(d.ID, "app-b", store.AddressModeWildcard, nil); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
if err := svc.PurgeDomainSASL(d.ID); err != nil {
|
||||
t.Fatalf("PurgeDomainSASL: %v", err)
|
||||
}
|
||||
if len(rec.set) != 0 {
|
||||
t.Errorf("SASL accounts remain after purge: %v", rec.set)
|
||||
}
|
||||
if len(rec.deleted) != 2 {
|
||||
t.Errorf("deleted %d logins, want 2", len(rec.deleted))
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user