inbound-antispam-panel: findings of the technical and security reviews

Steps 11 and 12 of docs/plans/inbound-antispam-panel.md: 12/12. Two
read-only reviews of d65d632..HEAD by different models (Opus,
technical; Fable, security), each given the code and questions, not
conclusions. Nothing Critical or High in the feature; the High the
technical review found outside it is the commit before this one.

Log tailer (internal/logtail/inbound.go):
  - the reply of a refusal ends at the first "; from=<", Postfix's own,
    and the HELO name after it is whatever is left. Taking the longest
    reply let a HELO name that spelt "; from=<..> to=<..> proto=.."
    supply the row's sender, recipient and reply - and so make a
    refusal read as the deny list's;
  - an address with a quote, a bracket or a space is not kept: a quoted
    sender could otherwise supply the recipient;
  - the journal is cut to its row cap every 500 rows written, not only
    every six hours;
  - a queue id is forgotten when the message is queued or the id is
    opened by another listener, and a stale place in the queue of
    arrivals no longer drops a live id;
  - milter-hold lines are not read: the held message reaches the
    journal milter, which writes its row - it was written twice.
Lists (internal/inbound/lists.go): a change of the table and the
rewrite of the files are one step under a mutex; a failed rewrite puts
a removed entry back and rewrites after taking a new one out.
Store: the row cap removes the oldest by time, as the page orders them.
Page: on a sheet a refusal's text is a Reply whatever it starts with.

Help and the guide say that an allow entry for a sender address trusts
an address anyone can claim (design commit before this one).

docs/security.md: the two reviews; the roles table gains Inbound > Log
and Filter lists; Mail path describes the milters, the tailer and the
lists; four accepted risks - the filter's verdict while it is down, an
allow entry by sender address, the list files' mode, log rows held by
domain name. The plan's stale lines (size and rate refusals, who reads
the journal) are corrected.

Left as found, told to the owner: the journal's rows after an unclean
stop may be written twice (the tailer saves its place every five
seconds); a "Deny sender" link is offered for an address the form then
refuses; 1.2.3.4 and 1.2.3.4/32 are two entries.

Checked on the test server, uncommitted tree: go vet ./... ok,
go test ./... ok (22 packages), make e2e ok.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/view/help.go

@@ -201,7 +201,7 @@ var inboundTopics = []HelpTopic{
 			", so its row has no subject, and a message refused after its text was sent is one row however many recipients it had. A refusal to relay for a domain that is not an inbound one is every scanner on the internet and is not recorded. Rows are kept for the number of days set in Settings, and never more than 10 000."),
 	}},
 	{ID: HelpFilterLists, Title: "Filter lists", Body: []Text{
-		Rich("Two lists for the whole server that correct the spam filter by hand. An entry is a sender address, a sender domain — that domain, not its subdomains — or a client address or network in CIDR form. A sender on the Deny list is refused outright. A sender on the Allow list is given a weight no spam score outweighs, so the filter lets it through. When entries of both lists match one message, ",
+		Rich("Two lists for the whole server that correct the spam filter by hand. An entry is a sender address, a sender domain — that domain, not its subdomains — or a client address or network in CIDR form. A sender on the Deny list is refused outright. A sender on the Allow list is given a weight no spam score outweighs, so the filter lets it through. The sender's address is whatever the sending server says it is - anyone can claim to be a sender you allow - so allow a client address or network where you can, and a sender address only for mail you would rather receive forged than lose. When entries of both lists match one message, ",
 			Strong("Deny wins"), ".",
 			Br(), Br(),
 			"SelfPost does not apply the lists itself: it writes them as files under ", Code("/data/antispam/"),

internal/web/view/inbound_log.go

@@ -146,7 +146,7 @@ func (p *InLog) NewRow(in InLogRowInput) InLogRow {
 		Time: FormatLogTime(in.At), From: orDash(in.From), Client: in.Client, To: in.To, Subject: in.Subject,
 		Why: Sheet{
 			ID: "why-" + strconv.FormatInt(in.ID, 10), Tag: Tag{Status: in.Decision}, Title: "Why",
-			Rows: whyRows(in.Engine, in.Detail, in.Subject),
+			Rows: whyRows(in.Decision, in.Engine, in.Detail, in.Subject),
 		},
 	}
 	if p.IsGlobal {
@@ -157,15 +157,15 @@ func (p *InLog) NewRow(in InLogRowInput) InLogRow {
 
 // whyRows is the content of a row's sheet: who decided, what they said, and
 // the subject whole, which the table clips. What was said has one of two
-// shapes, told apart by how it starts. The inbound journal milter writes the
-// filter's verdict on mail that passed - an action and a score, then the
-// symbols after a semicolon. The log tailer writes the reply a refusal was
-// given, which starts with its code.
-func whyRows(engine, detail, subject string) []SheetRow {
+// shapes, and the decision says which. Mail that passed was written by the
+// inbound journal milter with the filter's verdict - an action and a score,
+// then the symbols after a semicolon. Mail that was refused or put off was
+// read from mail.log by the tailer, with the reply it was given.
+func whyRows(decision, engine, detail, subject string) []SheetRow {
 	rows := []SheetRow{{Label: "Decided by", Lines: []string{engine}}}
 	switch {
 	case detail == "":
-	case detail[0] >= '0' && detail[0] <= '9':
+	case decision == "reject" || decision == "tempfail":
 		rows = append(rows, SheetRow{Label: "Reply", Lines: []string{detail}, Mono: true})
 	default:
 		verdict, symbols, _ := strings.Cut(detail, "; ")

internal/web/view/inbound_log_test.go

@@ -284,18 +284,20 @@ func TestWhyRows(t *testing.T) {
 		}
 		return strings.Join(out, "; ")
 	}
-	for _, c := range []struct{ engine, detail, subject, want string }{
-		{"selfpost", "", "", "Decided by=selfpost"},
-		{"selfpost", "", "Hello", "Decided by=selfpost; Subject=Hello"},
-		{"rspamd", "no action, score 0.40 / 15.00", "Hi", "Decided by=rspamd; Verdict=no action, score 0.40 / 15.00; Subject=Hi"},
-		{"rspamd", "add header, score 9.80 / 15.00; A(5.00) B(-0.10)", "", "Decided by=rspamd; Verdict=add header, score 9.80 / 15.00; Symbols=A(5.00)|B(-0.10)"},
+	for _, c := range []struct{ decision, engine, detail, subject, want string }{
+		{"accept", "selfpost", "", "", "Decided by=selfpost"},
+		{"accept", "selfpost", "", "Hello", "Decided by=selfpost; Subject=Hello"},
+		{"accept", "rspamd", "no action, score 0.40 / 15.00", "Hi", "Decided by=rspamd; Verdict=no action, score 0.40 / 15.00; Subject=Hi"},
+		{"accept", "rspamd", "add header, score 9.80 / 15.00; A(5.00) B(-0.10)", "", "Decided by=rspamd; Verdict=add header, score 9.80 / 15.00; Symbols=A(5.00)|B(-0.10)"},
 		// a verdict with symbols and no action or score
-		{"rspamd", "A(5.00)", "", "Decided by=rspamd; Verdict=A(5.00)"},
-		{"rspamd", "5.7.1 Spam message rejected", "", "Decided by=rspamd; Reply=5.7.1 Spam message rejected"},
-		{"postfix", "450 4.1.8 <a@nx.example>: Sender address rejected; see x", "", "Decided by=postfix; Reply=450 4.1.8 <a@nx.example>: Sender address rejected; see x"},
+		{"quarantine", "rspamd", "A(5.00)", "", "Decided by=rspamd; Verdict=A(5.00)"},
+		{"reject", "rspamd", "5.7.1 Spam message rejected", "", "Decided by=rspamd; Reply=5.7.1 Spam message rejected"},
+		{"tempfail", "postfix", "450 4.1.8 <a@nx.example>: Sender address rejected; see x", "", "Decided by=postfix; Reply=450 4.1.8 <a@nx.example>: Sender address rejected; see x"},
+		// a refusal's text is a reply whatever it starts with
+		{"reject", "rspamd", "milter triggers DISCARD action", "", "Decided by=rspamd; Reply=milter triggers DISCARD action"},
 	} {
-		if got := flat(whyRows(c.engine, c.detail, c.subject)); got != c.want {
-			t.Errorf("whyRows(%q, %q, %q)\n got: %s\nwant: %s", c.engine, c.detail, c.subject, got, c.want)
+		if got := flat(whyRows(c.decision, c.engine, c.detail, c.subject)); got != c.want {
+			t.Errorf("whyRows(%q, %q, %q, %q)\n got: %s\nwant: %s", c.decision, c.engine, c.detail, c.subject, got, c.want)
 		}
 	}
 }