findings of the reviews of audit stage 2

Technical review (Opus) and security review (Fable) of a59e3d4..cb5a4a2;
reports in the session's scratchpad. Nothing critical, high or medium; no
outright bug. Fixed:

- F2, F3 (0008 backfill, before it runs on the live database): rows are
  filled by the rule new rows follow - the application's domain, then the
  name's - and only by a domain and application that existed when the row
  was written (created_at); the inbound log likewise. Test: the migration's
  UPDATEs re-run on prepared rows (before the domain, after, null sender,
  application gone, a stranger's name). Dry run on a copy of the live
  database: 68/68 and 10/10 rows filled, none disagreeing with its login's
  domain, integrity ok.
- V2, F4: an application's statistics and level-2 count are its login's
  rows of its domain (appByLogin), and StatsWindow starts no earlier than
  the entity's creation; the message page's "may send as" only for a login
  still of the row's domain. Test: a login taken again in another domain
  starts at zero.
- F7: MAIL FROM:<> is held to the domain limit of its login
  (ApplicationByLogin fills DomainName).
- V3: an imported DKIM selector is held to DNS labels (validate.Selector).
- F5, F6: an imported auto limit's numbers are dropped and recalculated
  right after the import; its mode is stored trimmed.
- V6: the store refuses a role that is neither global nor domain.
- F9: SaveUser keeps the stored hash when no new password is given (the
  form no longer writes back the hash it read). F10: a reach naming a
  domain deleted meanwhile is ErrNoSuchDomain, answered on the form.
- V4, F12: from-lines-other.txt - lines naming another sender ({other}) in
  a quoted string, a quoted pair, capitals, a comment, an encoded word, a
  quoted local part; the unit test wants each refused, the e2e
  (lines_naming_another_sender_never_signed_for_it) wants each refused and
  none signed for it. The passed list gained a.{DOMAIN}, a comment after
  the angle address, a quoted local part, and "b@ {other}" - passed by
  design (security.md), and the e2e shows it signed for the own domain.
- F13: e2e login_in_other_capitals_does_not_authenticate - AUTH with the
  login upper-cased gets 535.

Not changed, written down: V1/F1 - L8 is half closed (refused or passed
still tells an application which domains are hosted here); security.md's
accepted risks and the CHANGELOG say so, and the owner is asked whether to
refuse every foreign address in a display name (changes the 2.4.0 rule).
F11 - deleting a domain rewrites its rows' domain_id (seconds at 1e5 rows),
accepted at this size. F8 (test cannot tell write-first from read-first;
the reviewer verified it with two stores, 30/30), V5, V7, P2: noted.

Evidence on the test server for this tree: go vet clean, go test ./... 23
packages ok, make e2e exit 0 with the three new cases.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/e2e/dkim_from_test.go

@@ -13,10 +13,12 @@ import (
 	"github.com/emersion/go-msgauth/dkim"
 )
 
-// passedFromLines reads the From: lines the sender check passes, the file its
-// unit test reads too, with the application's domain put in.
-func passedFromLines(repoRoot, domain string) ([]string, error) {
-	raw, err := os.ReadFile(filepath.Join(repoRoot, "internal", "milter", "testdata", "from-lines-passed.txt"))
+// fromLines reads one of the files of From: lines the sender check's unit
+// test reads too, with the placeholders put in: {domain} the application's,
+// {other} another sender of the server, each also in capitals, and
+// {other_qp} with its dots as quoted pairs.
+func fromLines(repoRoot, file, domain, other string) ([]string, error) {
+	raw, err := os.ReadFile(filepath.Join(repoRoot, "internal", "milter", "testdata", file))
 	if err != nil {
 		return nil, err
 	}
@@ -30,7 +32,11 @@ func passedFromLines(repoRoot, domain string) ([]string, error) {
 		if err != nil {
 			return nil, fmt.Errorf("%s: %w", line, err)
 		}
-		out = append(out, strings.ReplaceAll(s, "{domain}", domain))
+		out = append(out, strings.NewReplacer(
+			"{domain}", domain, "{DOMAIN}", strings.ToUpper(domain),
+			"{other_qp}", strings.ReplaceAll(other, ".", `\.`),
+			"{other}", other, "{OTHER}", strings.ToUpper(other),
+		).Replace(s))
 	}
 	return out, nil
 }
@@ -43,7 +49,7 @@ func passedFromLines(repoRoot, domain string) ([]string, error) {
 // application's own and OpenDKIM as another sender's would be signed with
 // that sender's key.
 func testSignedForItsDomainOnly(t *testing.T, sc *scenario) {
-	lines, err := passedFromLines(h.repoRoot, senderDomain)
+	lines, err := fromLines(h.repoRoot, "from-lines-passed.txt", senderDomain, otherDomain)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -82,3 +88,49 @@ func testSignedForItsDomainOnly(t *testing.T, sc *scenario) {
 		}
 	}
 }
+
+// testNeverSignedForAnother: the lines that name another sender of the server
+// are refused by the check; whatever happens to one, nothing arrives signed
+// with that sender's key (review of audit stage 2).
+func testNeverSignedForAnother(t *testing.T, sc *scenario) {
+	lines, err := fromLines(h.repoRoot, "from-lines-other.txt", senderDomain, otherDomain)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, line := range lines {
+		token := uniqueToken("dkimother")
+		res := attemptSend(sendAttempt{
+			authLogin: sc.appLogin, authPassword: sc.appPassword,
+			from: "alerts@" + senderDomain, headerFrom: line, to: recipient,
+			subject: "e2e " + token, body: "which key signs this",
+		})
+		if err := res.refusedAt("DATA", 550, "5.7.1 From:"); err == nil {
+			continue
+		}
+		t.Errorf("From: %q was not refused by the check: %v", line, res.firstErr())
+		raw, err := findSinkMessage(h.stageDir, token, 15*time.Second)
+		if err != nil {
+			continue
+		}
+		verifications, _ := dkim.VerifyWithOptions(bytes.NewReader(raw), &dkim.VerifyOptions{LookupTXT: lookupTXTFunc()})
+		for _, v := range verifications {
+			if v.Domain == otherDomain {
+				t.Errorf("From: %q arrived signed for %s", line, otherDomain)
+			}
+		}
+	}
+}
+
+// testLoginCaseMatters: SASL compares the login byte for byte, so an
+// application's login in other capitals does not authenticate. Every lookup on
+// the mail path is by the exact login and relies on that (review of audit
+// stage 2, F13).
+func testLoginCaseMatters(t *testing.T, sc *scenario) {
+	res := attemptSend(sendAttempt{
+		authLogin: strings.ToUpper(sc.appLogin), authPassword: sc.appPassword,
+		from: "alerts@" + senderDomain, to: recipient, subject: "e2e " + uniqueToken("case"), body: "x",
+	})
+	if err := res.refusedAt("AUTH", 535, ""); err != nil {
+		t.Fatalf("AUTH as %s: %v", strings.ToUpper(sc.appLogin), err)
+	}
+}

test/e2e/main_test.go

@@ -313,6 +313,12 @@ func TestE2E(t *testing.T) {
 	run("passed_from_lines_signed_for_their_domain_only", func(t *testing.T) {
 		testSignedForItsDomainOnly(t, sc)
 	})
+	run("lines_naming_another_sender_never_signed_for_it", func(t *testing.T) {
+		testNeverSignedForAnother(t, sc)
+	})
+	run("login_in_other_capitals_does_not_authenticate", func(t *testing.T) {
+		testLoginCaseMatters(t, sc)
+	})
 	run("panel_down_defers_mail", func(t *testing.T) {
 		testPanelDownDefersMail(t, sc)
 	})