findings of the reviews of audit stage 2

Technical review (Opus) and security review (Fable) of a59e3d4..cb5a4a2;
reports in the session's scratchpad. Nothing critical, high or medium; no
outright bug. Fixed:

- F2, F3 (0008 backfill, before it runs on the live database): rows are
  filled by the rule new rows follow - the application's domain, then the
  name's - and only by a domain and application that existed when the row
  was written (created_at); the inbound log likewise. Test: the migration's
  UPDATEs re-run on prepared rows (before the domain, after, null sender,
  application gone, a stranger's name). Dry run on a copy of the live
  database: 68/68 and 10/10 rows filled, none disagreeing with its login's
  domain, integrity ok.
- V2, F4: an application's statistics and level-2 count are its login's
  rows of its domain (appByLogin), and StatsWindow starts no earlier than
  the entity's creation; the message page's "may send as" only for a login
  still of the row's domain. Test: a login taken again in another domain
  starts at zero.
- F7: MAIL FROM:<> is held to the domain limit of its login
  (ApplicationByLogin fills DomainName).
- V3: an imported DKIM selector is held to DNS labels (validate.Selector).
- F5, F6: an imported auto limit's numbers are dropped and recalculated
  right after the import; its mode is stored trimmed.
- V6: the store refuses a role that is neither global nor domain.
- F9: SaveUser keeps the stored hash when no new password is given (the
  form no longer writes back the hash it read). F10: a reach naming a
  domain deleted meanwhile is ErrNoSuchDomain, answered on the form.
- V4, F12: from-lines-other.txt - lines naming another sender ({other}) in
  a quoted string, a quoted pair, capitals, a comment, an encoded word, a
  quoted local part; the unit test wants each refused, the e2e
  (lines_naming_another_sender_never_signed_for_it) wants each refused and
  none signed for it. The passed list gained a.{DOMAIN}, a comment after
  the angle address, a quoted local part, and "b@ {other}" - passed by
  design (security.md), and the e2e shows it signed for the own domain.
- F13: e2e login_in_other_capitals_does_not_authenticate - AUTH with the
  login upper-cased gets 535.

Not changed, written down: V1/F1 - L8 is half closed (refused or passed
still tells an application which domains are hosted here); security.md's
accepted risks and the CHANGELOG say so, and the owner is asked whether to
refuse every foreign address in a display name (changes the 2.4.0 rule).
F11 - deleting a domain rewrites its rows' domain_id (seconds at 1e5 rows),
accepted at this size. F8 (test cannot tell write-first from read-first;
the reviewer verified it with two stores, 30/30), V5, V7, P2: noted.

Evidence on the test server for this tree: go vet clean, go test ./... 23
packages ok, make e2e exit 0 with the three new cases.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/milter/milter_test.go

@@ -700,3 +700,18 @@ func TestDomainOf(t *testing.T) {
 		}
 	}
 }
+
+// MAIL FROM:<> has no domain of its own; it is held to the limit of its
+// login's domain like the application's other mail (review of audit stage 2).
+func TestRateLimitHoldsTheNullSenderToItsLoginsDomain(t *testing.T) {
+	rec := &fakeRecorder{
+		apps: map[string]store.Application{"app1": {Login: "app1", DomainName: "example.com"}},
+		limits: map[string]store.RateLimit{
+			store.RateLimitScopeDomain + "|example.com": domainLimit(),
+		},
+		counts: map[string]int64{store.RateLimitScopeDomain + "|example.com": 5}, // == max
+	}
+	if resp := mailFrom(t, rec, limitIP, "<>", "app1"); resp != milter.RespTempFail {
+		t.Fatalf("a null sender over its domain's limit = %v, want TempFail (4xx)", resp)
+	}
+}

internal/milter/ratelimit.go

@@ -39,6 +39,14 @@ func (s *session) overLimit() bool {
 	}
 
 	domain := domainOf(s.from)
+	if domain == "" && s.login != "" {
+		// MAIL FROM:<> has no domain to read; the login has one. A null
+		// sender is held to its application's domain like any other message
+		// of it (review of audit stage 2).
+		if a, err := s.rec.ApplicationByLogin(s.login); err == nil {
+			domain = a.DomainName
+		}
+	}
 	if domain == "" {
 		return false
 	}

internal/milter/sender_test.go

@@ -283,8 +283,15 @@ func TestSenderCheckRefusalWithNullSenderHasItsDomain(t *testing.T) {
 
 // passedFromLines reads testdata/from-lines-passed.txt with {domain} put in.
 func passedFromLines(t *testing.T, domain string) []string {
+	return fromLines(t, "from-lines-passed.txt", domain, "news.example.net")
+}
+
+// fromLines reads one of the shared files of From: lines with the
+// placeholders put in: {domain}, {DOMAIN} (in capitals), {other}, {OTHER} and
+// {other_qp} (its dots as quoted pairs).
+func fromLines(t *testing.T, file, domain, other string) []string {
 	t.Helper()
-	raw, err := os.ReadFile(filepath.Join("testdata", "from-lines-passed.txt"))
+	raw, err := os.ReadFile(filepath.Join("testdata", file))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -298,11 +305,27 @@ func passedFromLines(t *testing.T, domain string) []string {
 		if err != nil {
 			t.Fatalf("%s: %v", line, err)
 		}
-		out = append(out, strings.ReplaceAll(s, "{domain}", domain))
+		out = append(out, strings.NewReplacer(
+			"{domain}", domain, "{DOMAIN}", strings.ToUpper(domain),
+			"{other_qp}", strings.ReplaceAll(other, ".", `\.`),
+			"{other}", other, "{OTHER}", strings.ToUpper(other),
+		).Replace(s))
 	}
 	return out
 }
 
+// Every line of the shared file of lines naming another sender is refused:
+// none may be passed to be signed with that sender's key.
+func TestSenderCheckRefusesTheSharedLinesNamingAnother(t *testing.T) {
+	bind := NewBindings(writeMaps(t, senderMaps))
+	for _, line := range fromLines(t, "from-lines-other.txt", "shop.example.org", "news.example.net") {
+		resp, _ := offer(t, bind, "shop", "shop@shop.example.org", [2]string{"From", line})
+		if resp == milter.RespContinue {
+			t.Errorf("From: %q passed", line)
+		}
+	}
+}
+
 // Every line of the shared file is passed for the domain's application; the
 // e2e then checks OpenDKIM signs each for that domain alone.
 func TestSenderCheckPassesTheSharedLines(t *testing.T) {

internal/milter/testdata/from-lines-other.txt

@@ -0,0 +1,22 @@
+# From: lines that name another sender of this server, {other}, beside or in
+# place of the application's own address at {domain} (review of audit stage
+# 2). The check must refuse each: a line it read as the application's own and
+# OpenDKIM as {other}'s would be signed with {other}'s key. The unit test
+# (internal/milter/sender_test.go) wants each refused; the e2e
+# (test/e2e/dkim_from_test.go) sends each and wants nothing signed for
+# {other}. {OTHER} is {other} in capitals; {other_qp} is {other} with each
+# dot escaped as a quoted pair. One Go-quoted string per line.
+"b@{other}"
+"<b@{other}>"
+"\"a@{domain}\"@{other}"
+"\"b@{other}\"@{domain}"
+"\"x\\\" <b@{other}>\" <a@{domain}>"
+"\"x\\\" <b@{other_qp}>\" <a@{domain}>"
+"\"b@{other}\" <a@{domain}>"
+"\"b@{OTHER}\" <a@{domain}>"
+"b@{other} <a@{domain}>"
+"a@{domain} (b@{other})"
+"<a@{domain}> (b@{other})"
+"(b@{other}) a@{domain}"
+"=?utf-8?q?b=40{other}?= <a@{domain}>"
+"\"x\" <b@{other}>, <a@{domain}>"

internal/milter/testdata/from-lines-passed.txt

@@ -4,7 +4,10 @@
 # domain. Two tests read this file: the check's unit test
 # (internal/milter/sender_test.go) wants each line passed, and the e2e
 # (test/e2e/dkim_from_test.go) sends each one and wants the message signed
-# for {domain} and nothing else. A line added here is run by both.
+# for {domain} and nothing else. A line added here is run by both. {DOMAIN}
+# is {domain} in capitals; {other} is another sender of the server, which a
+# line here names in a way the check's scan does not see (a space after the
+# @) - passed by design, and so signed for {domain} alone.
 "a@{domain}"
 "<a@{domain}>"
 "\"The Shop\" <Orders@{domain}>"
@@ -20,3 +23,7 @@
 "=?utf-8?b?0JzQsNCz0LDQt9C40L0=?=\r\n\t<a@{domain}>"
 "a@{domain} (the shop)"
 "a@{domain} (the (nested) shop)"
+"a@{DOMAIN}"
+"<a@{domain}> (the shop)"
+"\"a@{domain}\"@{domain}"
+"\"b@ {other}\" <a@{domain}>"