findings of the reviews of audit stage 2

Technical review (Opus) and security review (Fable) of a59e3d4..cb5a4a2;
reports in the session's scratchpad. Nothing critical, high or medium; no
outright bug. Fixed:

- F2, F3 (0008 backfill, before it runs on the live database): rows are
  filled by the rule new rows follow - the application's domain, then the
  name's - and only by a domain and application that existed when the row
  was written (created_at); the inbound log likewise. Test: the migration's
  UPDATEs re-run on prepared rows (before the domain, after, null sender,
  application gone, a stranger's name). Dry run on a copy of the live
  database: 68/68 and 10/10 rows filled, none disagreeing with its login's
  domain, integrity ok.
- V2, F4: an application's statistics and level-2 count are its login's
  rows of its domain (appByLogin), and StatsWindow starts no earlier than
  the entity's creation; the message page's "may send as" only for a login
  still of the row's domain. Test: a login taken again in another domain
  starts at zero.
- F7: MAIL FROM:<> is held to the domain limit of its login
  (ApplicationByLogin fills DomainName).
- V3: an imported DKIM selector is held to DNS labels (validate.Selector).
- F5, F6: an imported auto limit's numbers are dropped and recalculated
  right after the import; its mode is stored trimmed.
- V6: the store refuses a role that is neither global nor domain.
- F9: SaveUser keeps the stored hash when no new password is given (the
  form no longer writes back the hash it read). F10: a reach naming a
  domain deleted meanwhile is ErrNoSuchDomain, answered on the form.
- V4, F12: from-lines-other.txt - lines naming another sender ({other}) in
  a quoted string, a quoted pair, capitals, a comment, an encoded word, a
  quoted local part; the unit test wants each refused, the e2e
  (lines_naming_another_sender_never_signed_for_it) wants each refused and
  none signed for it. The passed list gained a.{DOMAIN}, a comment after
  the angle address, a quoted local part, and "b@ {other}" - passed by
  design (security.md), and the e2e shows it signed for the own domain.
- F13: e2e login_in_other_capitals_does_not_authenticate - AUTH with the
  login upper-cased gets 535.

Not changed, written down: V1/F1 - L8 is half closed (refused or passed
still tells an application which domains are hosted here); security.md's
accepted risks and the CHANGELOG say so, and the owner is asked whether to
refuse every foreign address in a display name (changes the 2.4.0 rule).
F11 - deleting a domain rewrites its rows' domain_id (seconds at 1e5 rows),
accepted at this size. F8 (test cannot tell write-first from read-first;
the reviewer verified it with two stores, 30/30), V5, V7, P2: noted.

Evidence on the test server for this tree: go vet clean, go test ./... 23
packages ok, make e2e exit 0 with the three new cases.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/handlers/handlers_backup.go

@@ -292,6 +292,7 @@ func (h *Handlers) HandleImportDomain(w http.ResponseWriter, r *http.Request) {
 	if exp.DMARCRua != "" {
 		h.resyncDMARC("domain import")
 	}
+	h.recalcImportedLimits(d, exp)
 	http.Redirect(w, r, fmt.Sprintf("/outbound/domains/%d?imported=1", d.ID), http.StatusSeeOther)
 }
 
@@ -384,6 +385,9 @@ func (h *Handlers) checkDomainImport(exp *domain.DomainExport) string {
 	invalid := func(what string, err error) string {
 		return "Invalid " + what + " in export file: " + err.Error()
 	}
+	if err := validate.Selector(exp.DKIMSelector); err != nil {
+		return invalid("DKIM selector", err)
+	}
 	if exp.DMARCRua != "" {
 		if err := validate.Email(exp.DMARCRua); err != nil {
 			return invalid("report address", err)
@@ -397,7 +401,12 @@ func (h *Handlers) checkDomainImport(exp *domain.DomainExport) string {
 		if err != nil {
 			return err
 		}
+		rl.Mode = mode // as the form stores it, trimmed
 		if mode == store.RateLimitModeAuto {
+			// An auto limit's numbers are this server's to work out from its
+			// own traffic, not the file's: they are dropped here and worked
+			// out right after the import (review of audit stage 2).
+			rl.MaxMessages, rl.WindowSeconds = 0, 0
 			if rl.AutoMultiplier == 0 {
 				return nil // as an empty field on the form: the default
 			}
@@ -434,3 +443,27 @@ func (h *Handlers) checkDomainImport(exp *domain.DomainExport) string {
 	}
 	return ""
 }
+
+// recalcImportedLimits works out the numbers of the auto limits an import
+// brought, at once rather than at the next six-hourly pass: the file's own
+// numbers were dropped (checkDomainImport). A failure is logged; the pass
+// tries again.
+func (h *Handlers) recalcImportedLimits(d store.Domain, exp domain.DomainExport) {
+	if exp.RateLimit != nil && exp.RateLimit.Mode == store.RateLimitModeAuto {
+		if err := h.recalcRateLimit(store.RateLimitScopeDomain, d.ID); err != nil {
+			logf("panel: import domain %q: recalculate its auto limit: %v", d.Name, err)
+		}
+	}
+	for _, a := range exp.Applications {
+		if a.RateLimit == nil || a.RateLimit.Mode != store.RateLimitModeAuto {
+			continue
+		}
+		app, err := h.store.GetApplicationByLogin(a.Login)
+		if err == nil {
+			err = h.recalcRateLimit(store.RateLimitScopeApp, app.ID)
+		}
+		if err != nil {
+			logf("panel: import domain %q: recalculate the auto limit of %s: %v", d.Name, a.Login, err)
+		}
+	}
+}

internal/web/handlers/handlers_import_test.go

@@ -21,9 +21,10 @@ func TestDomainImportIsCheckedLikeTheForms(t *testing.T) {
 	h, _ := inboundHandlers(t)
 	good := func() domain.DomainExport {
 		return domain.DomainExport{
-			Domain:    "example.com",
-			DMARCRua:  "reports@example.com",
-			RateLimit: &domain.RateLimitExport{Mode: store.RateLimitModeManual, MaxMessages: 10, WindowSeconds: 3600},
+			Domain:       "example.com",
+			DKIMSelector: "mail.2026",
+			DMARCRua:     "reports@example.com",
+			RateLimit:    &domain.RateLimitExport{Mode: store.RateLimitModeManual, MaxMessages: 10, WindowSeconds: 3600},
 			Applications: []domain.AppExport{{
 				Login: "app1", AddressMode: store.AddressModeWildcard, Password: "imported-password",
 				AuthIPRestrict: true, AuthAllowedIPs: []string{"192.0.2.1", " 2001:DB8::1 "},
@@ -39,11 +40,26 @@ func TestDomainImportIsCheckedLikeTheForms(t *testing.T) {
 		t.Errorf("client addresses stored as %q, want as the form stores them", got)
 	}
 
+	// An auto limit's numbers are worked out here, not taken from the file,
+	// and its mode is stored trimmed.
+	exp = good()
+	exp.Applications[0].RateLimit = &domain.RateLimitExport{Mode: " auto ", MaxMessages: 1, WindowSeconds: 86400}
+	if msg := h.checkDomainImport(&exp); msg != "" {
+		t.Fatalf("an auto limit with numbers refused: %s", msg)
+	}
+	if rl := exp.Applications[0].RateLimit; rl.Mode != store.RateLimitModeAuto || rl.MaxMessages != 0 || rl.WindowSeconds != 0 {
+		t.Errorf("the auto limit kept %+v", rl)
+	}
+
 	for _, c := range []struct {
 		name   string
 		break_ func(*domain.DomainExport)
 		want   string
 	}{
+		{"selector", func(e *domain.DomainExport) { e.DKIMSelector = "mail;x=y" },
+			"Invalid DKIM selector in export file: selector: domain may contain only"},
+		{"long selector", func(e *domain.DomainExport) { e.DKIMSelector = strings.Repeat("a", 64) },
+			"Invalid DKIM selector in export file: selector must be at most 63 characters"},
 		{"report address", func(e *domain.DomainExport) { e.DMARCRua = "not an address" },
 			"Invalid report address in export file: "},
 		{"no window", func(e *domain.DomainExport) { e.RateLimit.WindowSeconds = 0 },

internal/web/handlers/handlers_monitor.go

@@ -123,19 +123,19 @@ func (h *Handlers) HandleDelivery(w http.ResponseWriter, r *http.Request) {
 		break
 	}
 	page := view.NewOutMessage(h.shellMeta(r), in).
-		WithHistory(deliveryEvents(row, h.cfg.RetryPolicy, h.sendsAs(row.AppLogin))).
+		WithHistory(deliveryEvents(row, h.cfg.RetryPolicy, h.sendsAs(row))).
 		// The mail.log lines for this message, and — when there are none — the
 		// reason, which is a normal outcome rather than a failure.
 		WithDeliveryLog(logLines, logNote)
 	h.view.Render(w, http.StatusOK, "out-message", page)
 }
 
-// sendsAs says what an application may send as, in the words of a refusal:
-// any address of its domain, or the addresses of its list. Empty when the
-// login is no application's any more.
-func (h *Handlers) sendsAs(login string) view.Text {
-	a, err := h.store.GetApplicationByLogin(login)
-	if err != nil {
+// sendsAs says what the row's application may send as, in the words of a
+// refusal: any address of its domain, or the addresses of its list. Empty when
+// the login is no application's any more, or is now another domain's.
+func (h *Handlers) sendsAs(row store.SendLogRow) view.Text {
+	a, err := h.store.GetApplicationByLogin(row.AppLogin)
+	if err != nil || a.DomainID != row.DomainID {
 		return nil
 	}
 	if a.AddressMode == store.AddressModeList {

internal/web/handlers/handlers_users.go

@@ -217,6 +217,10 @@ func (h *Handlers) submitUserCreate(w http.ResponseWriter, r *http.Request) {
 			h.renderUserForm(w, r, http.StatusConflict, 0, userFormView{FormErr: "That username is already in use.", FormUsername: username, FormEmail: email, FormRole: string(role), Reach: reach})
 			return
 		}
+		if errors.Is(err, store.ErrNoSuchDomain) {
+			h.renderUserForm(w, r, http.StatusConflict, 0, userFormView{FormErr: "A domain chosen here has been deleted meanwhile. Choose again.", FormUsername: username, FormEmail: email, FormRole: string(role), Reach: reach})
+			return
+		}
 		logf("panel: create user: %v", err)
 		h.renderUserForm(w, r, http.StatusInternalServerError, 0, userFormView{FormErr: "Could not create user. Please check the logs."})
 		return
@@ -283,7 +287,7 @@ func (h *Handlers) submitUserUpdate(w http.ResponseWriter, r *http.Request, u st
 		}
 	}
 
-	hash := u.PasswordHash
+	hash := "" // empty keeps the stored hash (SaveUser)
 	if password != "" {
 		if err := validate.AdminPassword(password); err != nil {
 			h.renderUserForm(w, r, http.StatusBadRequest, u.ID, userFormView{FormErr: err.Error(), FormUsername: username, FormEmail: email, FormRole: string(role), Reach: reach})
@@ -308,6 +312,9 @@ func (h *Handlers) submitUserUpdate(w http.ResponseWriter, r *http.Request, u st
 	case errors.Is(err, store.ErrLastGlobal):
 		lastGlobal()
 		return
+	case errors.Is(err, store.ErrNoSuchDomain):
+		h.renderUserForm(w, r, http.StatusConflict, u.ID, userFormView{FormErr: "A domain chosen here has been deleted meanwhile. Choose again.", FormUsername: username, FormEmail: email, FormRole: string(role), Reach: reach})
+		return
 	case err != nil:
 		logf("panel: update user: %v", err)
 		h.renderUserForm(w, r, http.StatusInternalServerError, u.ID, userFormView{FormErr: "Could not save user. Please check the logs.", FormUsername: username, FormEmail: email, FormRole: string(role), Reach: reach})

internal/web/validate/validate.go

@@ -82,6 +82,26 @@ func Domain(name string) error {
 	return nil
 }
 
+// Selector checks a DKIM selector: one or more DNS labels as Domain allows
+// them, at most 63 characters in all. The panel's own selector is fixed in
+// its configuration; this is for one read from a domain export file, which
+// goes into OpenDKIM's tables, a key file's name and every signature's s=
+// (review of audit stage 2).
+func Selector(s string) error {
+	if s == "" {
+		return fmt.Errorf("selector is required")
+	}
+	if len(s) > 63 {
+		return fmt.Errorf("selector must be at most 63 characters")
+	}
+	for _, label := range strings.Split(s, ".") {
+		if err := domainLabel(label); err != nil {
+			return fmt.Errorf("selector: %w", err)
+		}
+	}
+	return nil
+}
+
 func domainLabel(label string) error {
 	if len(label) == 0 {
 		return fmt.Errorf("domain must not contain an empty label")