Phase 2: SQLite persistence, admin setup-link, login/sessions

Implements the secure single-admin panel entry (spec 7.6). - internal/store: modernc.org/sqlite (pure Go, static build), WAL + foreign keys, embedded PRAGMA user_version migrations; schema 0001 covers admin/settings/domains/applications/send_log/rate_limits (spec 9). - Setup secret-link (spec 7.6.1): 128-bit crypto/rand token, printed to log + /data/setup-token (0600), 10-min TTL with regeneration, per-IP rate limit, subtle.ConstantTimeCompare, failures don't invalidate, one-time admin form, permanent invalidation once admin exists (/setup 404). - bcrypt admin password; server-side username/password validation. - Login + in-memory sessions, crypto-random token, cookie HttpOnly/Secure/SameSite (Secure toggleable for dev HTTP), login rate limit, auth middleware. - html/template base layout + setup/login/dashboard, vendored htmx 2.0.4. - build/entrypoint.sh: fix bind-mounted /data ownership as root before supervisord drops to the unprivileged panel user (found via container test). Verified on selfpost.example.com: go vet/build/test/gofmt clean; e2e curl of setup+login flows; docker build + run with -v ./data:/data creates the DB and 0600 token owned by panel. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-11 21:24:09 +03:00
parent 85f3374ce1
commit d72a383904
25 changed files with 1248 additions and 50 deletions
@@ -0,0 +1,61 @@
+package store
+
+import (
+	"database/sql"
+	"errors"
+	"fmt"
+	"time"
+)
+
+// ErrNoAdmin is returned by GetAdmin when primary setup has not happened yet.
+var ErrNoAdmin = errors.New("no administrator account")
+
+// Admin is the single panel administrator (spec 7.6.1).
+type Admin struct {
+	Username     string
+	PasswordHash string
+	CreatedAt    time.Time
+}
+
+// AdminExists reports whether the administrator account has been created. This
+// doubles as the "primary setup complete" flag: once true, the /setup route is
+// permanently gone (spec 7.6.1).
+func (s *Store) AdminExists() (bool, error) {
+	var n int
+	if err := s.db.QueryRow("SELECT COUNT(*) FROM admin").Scan(&n); err != nil {
+		return false, fmt.Errorf("count admin: %w", err)
+	}
+	return n > 0, nil
+}
+
+// CreateAdmin inserts the administrator row. It fails if one already exists,
+// which — combined with the id=1 constraint — makes admin creation one-shot
+// even under a race between two setup submissions.
+func (s *Store) CreateAdmin(username, passwordHash string) error {
+	_, err := s.db.Exec(
+		"INSERT INTO admin (id, username, password_hash, created_at) VALUES (1, ?, ?, ?)",
+		username, passwordHash, time.Now().UTC().Format(time.RFC3339),
+	)
+	if err != nil {
+		return fmt.Errorf("create admin: %w", err)
+	}
+	return nil
+}
+
+// GetAdmin returns the administrator account, or ErrNoAdmin if setup is pending.
+func (s *Store) GetAdmin() (Admin, error) {
+	var (
+		a         Admin
+		createdAt string
+	)
+	err := s.db.QueryRow("SELECT username, password_hash, created_at FROM admin WHERE id = 1").
+		Scan(&a.Username, &a.PasswordHash, &createdAt)
+	if errors.Is(err, sql.ErrNoRows) {
+		return Admin{}, ErrNoAdmin
+	}
+	if err != nil {
+		return Admin{}, fmt.Errorf("get admin: %w", err)
+	}
+	a.CreatedAt, _ = time.Parse(time.RFC3339, createdAt)
+	return a, nil
+}
@@ -0,0 +1,76 @@
+-- Initial SelfPost schema (spec 9). One SQLite file under /data holds the whole
+-- panel state so a single directory backup/restore is sufficient (spec 7.5.A).
+
+-- Single administrator account (spec 7.6.1). Exactly one row is allowed; the
+-- presence of that row is what marks primary setup as complete, which is why
+-- the /setup route disappears once it exists.
+CREATE TABLE admin (
+    id            INTEGER PRIMARY KEY CHECK (id = 1),
+    username      TEXT NOT NULL,
+    password_hash TEXT NOT NULL,
+    created_at    TEXT NOT NULL
+);
+
+-- Free-form key/value panel settings (retention overrides, misc flags).
+CREATE TABLE settings (
+    key   TEXT PRIMARY KEY,
+    value TEXT NOT NULL
+);
+
+-- Sending domains managed through the panel (spec 4.1). DKIM keys themselves
+-- live on disk under /data; this row records the selector and metadata.
+CREATE TABLE domains (
+    id            INTEGER PRIMARY KEY AUTOINCREMENT,
+    name          TEXT NOT NULL UNIQUE,
+    dkim_selector TEXT NOT NULL,
+    created_at    TEXT NOT NULL
+);
+
+-- Applications bound to a domain (spec 4.1). address_mode is either the domain
+-- wildcard or an explicit address list; the SASL login is globally unique.
+CREATE TABLE applications (
+    id           INTEGER PRIMARY KEY AUTOINCREMENT,
+    domain_id    INTEGER NOT NULL REFERENCES domains(id) ON DELETE CASCADE,
+    login        TEXT NOT NULL UNIQUE,
+    address_mode TEXT NOT NULL CHECK (address_mode IN ('wildcard', 'list')),
+    created_at   TEXT NOT NULL
+);
+
+-- Explicit sender addresses for applications in 'list' mode. Each address must
+-- belong to the application's domain (validated in the panel, spec 7.6.2).
+CREATE TABLE application_addresses (
+    id             INTEGER PRIMARY KEY AUTOINCREMENT,
+    application_id INTEGER NOT NULL REFERENCES applications(id) ON DELETE CASCADE,
+    address        TEXT NOT NULL,
+    UNIQUE (application_id, address)
+);
+
+-- Structured send log (spec 7.3). One row per (queue-id, recipient); the
+-- log-tailer advances status from queued to a final state.
+CREATE TABLE send_log (
+    id         INTEGER PRIMARY KEY AUTOINCREMENT,
+    queue_id   TEXT,
+    domain     TEXT,
+    app_login  TEXT,
+    from_addr  TEXT,
+    to_addr    TEXT,
+    subject    TEXT,
+    status     TEXT NOT NULL,
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL
+);
+CREATE INDEX idx_send_log_queue_id ON send_log (queue_id);
+CREATE INDEX idx_send_log_domain ON send_log (domain);
+CREATE INDEX idx_send_log_created_at ON send_log (created_at);
+
+-- Differentiated rate limits per domain/application (spec 7.4). Both the IP
+-- binding and the message limit are optional.
+CREATE TABLE rate_limits (
+    id             INTEGER PRIMARY KEY AUTOINCREMENT,
+    scope          TEXT NOT NULL CHECK (scope IN ('domain', 'application')),
+    ref_id         INTEGER NOT NULL,
+    allowed_ips    TEXT,
+    max_messages   INTEGER,
+    window_seconds INTEGER,
+    UNIQUE (scope, ref_id)
+);
@@ -0,0 +1,100 @@
+// Package store owns the SelfPost SQLite database: the single file under /data
+// that persists the administrator account, sending domains and applications,
+// the send log and rate-limit settings (spec 9). It exposes typed queries so
+// the rest of the panel never builds SQL by hand.
+package store
+
+import (
+	"database/sql"
+	"embed"
+	"fmt"
+	"io/fs"
+	"sort"
+
+	_ "modernc.org/sqlite" // pure-Go SQLite driver (no cgo), keeps the static build
+)
+
+//go:embed migrations/*.sql
+var migrationsFS embed.FS
+
+// Store wraps the database connection pool.
+type Store struct {
+	db *sql.DB
+}
+
+// Open opens (creating if needed) the SQLite database at path, enables WAL and
+// foreign keys, and applies any pending migrations. The caller owns Close.
+func Open(path string) (*Store, error) {
+	// _pragma parameters are applied on every pooled connection by the driver,
+	// so foreign-key enforcement and WAL survive connection churn.
+	dsn := fmt.Sprintf("file:%s?_pragma=journal_mode(WAL)&_pragma=busy_timeout(5000)&_pragma=foreign_keys(ON)", path)
+	db, err := sql.Open("sqlite", dsn)
+	if err != nil {
+		return nil, fmt.Errorf("open database: %w", err)
+	}
+	// modernc's driver serializes writes anyway; a small pool avoids
+	// "database is locked" surprises under WAL.
+	db.SetMaxOpenConns(1)
+
+	s := &Store{db: db}
+	if err := s.migrate(); err != nil {
+		db.Close()
+		return nil, err
+	}
+	return s, nil
+}
+
+// Close closes the underlying database.
+func (s *Store) Close() error {
+	return s.db.Close()
+}
+
+// migrate applies embedded migrations in filename order, tracking progress via
+// SQLite's PRAGMA user_version so each migration runs at most once.
+func (s *Store) migrate() error {
+	entries, err := fs.ReadDir(migrationsFS, "migrations")
+	if err != nil {
+		return fmt.Errorf("read migrations: %w", err)
+	}
+	names := make([]string, 0, len(entries))
+	for _, e := range entries {
+		if !e.IsDir() {
+			names = append(names, e.Name())
+		}
+	}
+	sort.Strings(names)
+
+	var version int
+	if err := s.db.QueryRow("PRAGMA user_version").Scan(&version); err != nil {
+		return fmt.Errorf("read schema version: %w", err)
+	}
+
+	for i, name := range names {
+		target := i + 1
+		if target <= version {
+			continue
+		}
+		sqlBytes, err := migrationsFS.ReadFile("migrations/" + name)
+		if err != nil {
+			return fmt.Errorf("read migration %s: %w", name, err)
+		}
+		tx, err := s.db.Begin()
+		if err != nil {
+			return fmt.Errorf("begin migration %s: %w", name, err)
+		}
+		if _, err := tx.Exec(string(sqlBytes)); err != nil {
+			tx.Rollback()
+			return fmt.Errorf("apply migration %s: %w", name, err)
+		}
+		// PRAGMA does not accept a bound parameter, and target is a trusted
+		// loop index, so formatting it in is safe.
+		if _, err := tx.Exec(fmt.Sprintf("PRAGMA user_version = %d", target)); err != nil {
+			tx.Rollback()
+			return fmt.Errorf("bump schema version for %s: %w", name, err)
+		}
+		if err := tx.Commit(); err != nil {
+			return fmt.Errorf("commit migration %s: %w", name, err)
+		}
+	}
+	return nil
+}