selfpost

31 Commits 1 Branch 3 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
mixandClaude Opus 5.5	bd746c61d7	panel-redesign: paths follow the menu; Account and Server settings split Stage 1, step 3 (plan § Routes). BREAKING: every panel URL changes and the old paths are removed without redirects. Routes (web.go) - /status -> /overview; /domains -> /outbound/domains with the domain's settings actions under .../settings/ (reports, ratelimit, export); /deliveries -> /outbound/log; /mail-queue -> /outbound/queue; /dmarc -> /outbound/dmarc; /inbound -> /inbound/domains; /system-log -> /server/log; /backup -> /server/backup (import under it); /users -> /server/users; recheck and reload under /server/health/. - One fragment name: <page>/fragment everywhere. - Everything under /server/ is registered through server(), which wraps the handler in globalOnly: the subtree is guarded once, where a new route cannot forget it. Handlers keep their own requireGlobal. - GET / leads to /overview, /outbound/domains or /inbound/domains. - The /account -> /settings redirect is gone with /settings. Account and Server > Settings - handlers_account.go: GET /account and three POSTs - profile (username, e-mail; no password asked, as designed), password (current password, rate-limited like a sign-in, signs out other sessions), dmarc (the user's default: hosted / account / custom / none, each validated). This replaces step 1's bridge through the old Settings form. - handlers_settings.go is the instance's page only: log retention and the read-only rate limits, global role. - One legacy template serves both pages by a flag until stage 2 gives each its own: a new legacy page cannot be added to the ratchet. Still to come inside stage 1, and why @routes stays on the ratchet: - step 4: the application routes (one POST, under the domain); - step 5: GET /server/health. With @routes removed by hand TestRoutesFollowNavigation reports exactly those and nothing else - no template links to a path the router lacks. Old templates, tests and the e2e client are retargeted. The e2e module was edited but not run here (no Docker, and its dependency could not be downloaded on this machine). Tests: Account (page, profile, password, DMARC default in every mode, a domain administrator's own row only), Server settings (saved without a password, range, global only), the /server/ subtree answered 404 by the router for a domain administrator with All on both lists and for no principal. go test ./... green except the two Windows-only failures in internal/domain and internal/logtail. Roadmap 13/27. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-09 21:51:55 +03:00
mixandClaude Opus 5.5	3b86f6c3b6	panel-redesign: inbound is delegated per user, separately from outbound Stage 1, step 2 (plan § Who sees what). Store - Reach{AllDomains, DomainIDs, AllInbound, InboundDomainIDs} is what a domain user is assigned. CreateUser takes it; SetUserReach / ClearUserReach replace SetUserDomains / ClearUserDomains and write both directions in one transaction. A domain user with nothing on either list is refused (ErrEmptyReach). With All set the rows of that direction are not stored, so clearing All later brings nothing stale back. - ListDomainsForUser honours all_domains; ListInboundDomainsForUser is its inbound twin. Both filter in the query. Authorization - auth.Principal carries the whole reach: CanAccessDomain (now also true with All), CanAccessInboundDomain, HasOutbound, HasInbound. An id or a name on one list opens nothing on the other. - Inbound handlers in three strengths: requireInbound (the list, filtered), requireInboundDomain (one domain: page, DNS re-check, upstream, recipients), requireInboundGlobal (add, delete confirm, delete). All answer the same 404. - domainIDSet and the DMARC report pages go through the principal instead of looking at p.Domains themselves. Panel (old templates, until stage 2) - User form: two lists with All; inbound is offered only where the feature is on, and saving the form with it off keeps the user's inbound reach. Promotion to global drops the reach. - Menu: a group with nothing assigned is absent; / sends an inbound-only administrator to Inbound. The inbound pages hide add / delete from a domain administrator. Tests: every route of one inbound domain against five kinds of refused request (another tenant's id, a missing id, outbound-only reach, an outbound domain with the same id, one with the same name, no principal) with the 404 bodies compared; add/delete as every non-global user; the filtered list including a domain added later; thirteen outbound routes against another tenant's domain and application id; the user form; the reach in the store; the principal matrix; the menu; the home redirect. Removing the access check or the query filter makes the tests fail (checked by hand). go test ./... green except the two Windows-only failures in internal/domain and internal/logtail that predate this work. Roadmap 12/27. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-09 20:33:37 +03:00
mix	60e08e802e	release: 1.2.0: Panel 1.2.0-1.2.5: layout, RBAC, tests, GUI and CI fixes [1.2.0] The second MINOR after 1.0.0: domain administrators with per-domain scope, a panel visual refresh on the SelfPost palette, and refinements to navigation and the send log. Upgrading runs one SQLite migration (`0005_panel_users`); the single administrator becomes a global user. Added: - panel: domain-admin role — global administrators manage panel users and Fixed: - Docker build: `LICENSE` is no longer excluded by `.dockerignore`, so the - panel: on signed-in pages with a narrow card (Settings, the user form) Changed: - panel: navigation session icons are distinct — Settings uses a gear, - panel: `/` redirects domain administrators to `/domains`; global users still - panel: Sign out in the navigation column uses the same type size and - panel: visual style brought in line with the SelfPost mark — brick accent - panel: the send log's status is a badge, in the same ok/warn/error/unknown … (1 more in CHANGELOG) [1.2.1] Panel refinements after 1.2.0: navigation icons, status-badge centreing, drill-down back-link placement, and safeguards for the sole global administrator. Upgrading is a tag bump; no migration. Fixed: - panel: status badge text sat low in the box (and below the heading or label - panel: the Users navigation icon was two full silhouettes with staggered - panel: the Settings navigation icon was a sun-with-rays (circle plus - panel: the user create/edit form placed «Back to users» at the bottom of the Changed: - panel: the user edit form disables role change and delete for the only global - panel: the user create/edit form hides Assigned domains when the role is - panel: Settings shows panel credentials and DMARC aggregate reports side [1.2.2] Status page layout after 1.2.1: paired cards in a wide column, denser machine and check copy, and a user-form checkbox fix. Upgrading is a tag bump; no migration. Changed: - panel: Status is wide again so paired cards fill the column. Layout: Fixed: - panel: cards inside `.split` used `margin: 0 auto`, which in a CSS grid - panel: on the user create/edit form, Assigned domains checkboxes stacked [1.2.3] Domain detail layout and panel polish after 1.2.2. Upgrading is a tag bump; no migration. Changed: - panel: the domain detail page is wide with paired cards (DKIM+SPF ‖ DMARC; - panel: Domains list — Add domain sits beside the domain field; the - panel: page URLs, browser titles, and headings are aligned — Settings is Fixed: - image: `mail.log` rotation no longer silently stops when the build context [1.2.4] Level-2 rate-limit semantics inverted after 1.2.3, plus a small DNS field height fix. Upgrading is a tag bump; no migration. Changed: - rate limiting (level 2): domain ceilings apply to every client IP (no IP Fixed: - panel: on the domain DNS status grid, the Type (TXT) field height matches [1.2.5] Rate-limit form polish after 1.2.4. Upgrading is a tag bump; no migration. Changed: - panel: rate-limit forms refined — level-1 backstop as muted copy on the Squashed CHANGELOG sections: [1.2.0], [1.2.1], [1.2.2], [1.2.3], [1.2.4], [1.2.5]. Full detail: CHANGELOG.md (1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.5).	2026-09-22 15:24:52 +03:00

Author

SHA1

Message

Date

mixandClaude Opus 5.5

bd746c61d7

panel-redesign: paths follow the menu; Account and Server settings split

Stage 1, step 3 (plan § Routes). BREAKING: every panel URL changes and the
old paths are removed without redirects.

Routes (web.go)
  - /status -> /overview; /domains -> /outbound/domains with the domain's
    settings actions under .../settings/ (reports, ratelimit, export);
    /deliveries -> /outbound/log; /mail-queue -> /outbound/queue; /dmarc ->
    /outbound/dmarc; /inbound -> /inbound/domains; /system-log ->
    /server/log; /backup -> /server/backup (import under it); /users ->
    /server/users; recheck and reload under /server/health/.
  - One fragment name: <page>/fragment everywhere.
  - Everything under /server/ is registered through server(), which wraps
    the handler in globalOnly: the subtree is guarded once, where a new
    route cannot forget it. Handlers keep their own requireGlobal.
  - GET / leads to /overview, /outbound/domains or /inbound/domains.
  - The /account -> /settings redirect is gone with /settings.

Account and Server > Settings
  - handlers_account.go: GET /account and three POSTs - profile (username,
    e-mail; no password asked, as designed), password (current password,
    rate-limited like a sign-in, signs out other sessions), dmarc (the
    user's default: hosted / account / custom / none, each validated).
    This replaces step 1's bridge through the old Settings form.
  - handlers_settings.go is the instance's page only: log retention and the
    read-only rate limits, global role.
  - One legacy template serves both pages by a flag until stage 2 gives each
    its own: a new legacy page cannot be added to the ratchet.

Still to come inside stage 1, and why @routes stays on the ratchet:
  - step 4: the application routes (one POST, under the domain);
  - step 5: GET /server/health.
With @routes removed by hand TestRoutesFollowNavigation reports exactly
those and nothing else - no template links to a path the router lacks.

Old templates, tests and the e2e client are retargeted. The e2e module was
edited but not run here (no Docker, and its dependency could not be
downloaded on this machine).

Tests: Account (page, profile, password, DMARC default in every mode, a
domain administrator's own row only), Server settings (saved without a
password, range, global only), the /server/ subtree answered 404 by the
router for a domain administrator with All on both lists and for no
principal.

go test ./...  green except the two Windows-only failures in internal/domain
and internal/logtail.

Roadmap 13/27.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-09 21:51:55 +03:00

mixandClaude Opus 5.5

3b86f6c3b6

panel-redesign: inbound is delegated per user, separately from outbound

Stage 1, step 2 (plan § Who sees what).

Store
  - Reach{AllDomains, DomainIDs, AllInbound, InboundDomainIDs} is what a
    domain user is assigned. CreateUser takes it; SetUserReach / ClearUserReach
    replace SetUserDomains / ClearUserDomains and write both directions in one
    transaction. A domain user with nothing on either list is refused
    (ErrEmptyReach). With All set the rows of that direction are not stored,
    so clearing All later brings nothing stale back.
  - ListDomainsForUser honours all_domains; ListInboundDomainsForUser is its
    inbound twin. Both filter in the query.

Authorization
  - auth.Principal carries the whole reach: CanAccessDomain (now also true
    with All), CanAccessInboundDomain, HasOutbound, HasInbound. An id or a
    name on one list opens nothing on the other.
  - Inbound handlers in three strengths: requireInbound (the list, filtered),
    requireInboundDomain (one domain: page, DNS re-check, upstream,
    recipients), requireInboundGlobal (add, delete confirm, delete). All
    answer the same 404.
  - domainIDSet and the DMARC report pages go through the principal instead
    of looking at p.Domains themselves.

Panel (old templates, until stage 2)
  - User form: two lists with All; inbound is offered only where the feature
    is on, and saving the form with it off keeps the user's inbound reach.
    Promotion to global drops the reach.
  - Menu: a group with nothing assigned is absent; / sends an inbound-only
    administrator to Inbound. The inbound pages hide add / delete from a
    domain administrator.

Tests: every route of one inbound domain against five kinds of refused
request (another tenant's id, a missing id, outbound-only reach, an outbound
domain with the same id, one with the same name, no principal) with the 404
bodies compared; add/delete as every non-global user; the filtered list
including a domain added later; thirteen outbound routes against another
tenant's domain and application id; the user form; the reach in the store;
the principal matrix; the menu; the home redirect. Removing the access check
or the query filter makes the tests fail (checked by hand).

go test ./...  green except the two Windows-only failures in internal/domain
and internal/logtail that predate this work.

Roadmap 12/27.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-09 20:33:37 +03:00

mix

60e08e802e

release: 1.2.0: Panel 1.2.0-1.2.5: layout, RBAC, tests, GUI and CI fixes

[1.2.0]
The second MINOR after 1.0.0: domain administrators with per-domain scope, a panel visual refresh on the SelfPost palette, and refinements to navigation and the send log. Upgrading runs one SQLite migration (`0005_panel_users`); the single administrator becomes a global user.
Added:
  - panel: **domain-admin role** — global administrators manage panel users and
Fixed:
  - Docker build: `LICENSE` is no longer excluded by `.dockerignore`, so the
  - panel: on signed-in pages with a narrow card (**Settings**, the user form)
Changed:
  - panel: navigation session icons are distinct — **Settings** uses a gear,
  - panel: `/` redirects domain administrators to `/domains`; global users still
  - panel: **Sign out** in the navigation column uses the same type size and
  - panel: **visual style** brought in line with the SelfPost mark — brick accent
  - panel: the send log's **status is a badge**, in the same ok/warn/error/unknown
  … (1 more in CHANGELOG)
[1.2.1]
Panel refinements after 1.2.0: navigation icons, status-badge centreing, drill-down back-link placement, and safeguards for the sole global administrator. Upgrading is a tag bump; no migration.
Fixed:
  - panel: status badge text sat low in the box (and below the heading or label
  - panel: the **Users** navigation icon was two full silhouettes with staggered
  - panel: the **Settings** navigation icon was a sun-with-rays (circle plus
  - panel: the user create/edit form placed «Back to users» at the bottom of the
Changed:
  - panel: the user edit form disables role change and delete for the only global
  - panel: the user create/edit form hides **Assigned domains** when the role is
  - panel: **Settings** shows panel credentials and DMARC aggregate reports side
[1.2.2]
Status page layout after 1.2.1: paired cards in a wide column, denser machine and check copy, and a user-form checkbox fix. Upgrading is a tag bump; no migration.
Changed:
  - panel: **Status** is wide again so paired cards fill the column. Layout:
Fixed:
  - panel: cards inside `.split` used `margin: 0 auto`, which in a CSS grid
  - panel: on the user create/edit form, **Assigned domains** checkboxes stacked
[1.2.3]
Domain detail layout and panel polish after 1.2.2. Upgrading is a tag bump; no migration.
Changed:
  - panel: the domain detail page is wide with paired cards (DKIM+SPF ‖ DMARC;
  - panel: Domains list — **Add domain** sits beside the domain field; the
  - panel: page URLs, browser titles, and headings are aligned — **Settings** is
Fixed:
  - image: `mail.log` rotation no longer silently stops when the build context
[1.2.4]
Level-2 rate-limit semantics inverted after 1.2.3, plus a small DNS field height fix. Upgrading is a tag bump; no migration.
Changed:
  - rate limiting (level 2): domain ceilings apply to every client IP (no IP
Fixed:
  - panel: on the domain DNS status grid, the Type (TXT) field height matches
[1.2.5]
Rate-limit form polish after 1.2.4. Upgrading is a tag bump; no migration.
Changed:
  - panel: rate-limit forms refined — level-1 backstop as muted copy on the

Squashed CHANGELOG sections: [1.2.0], [1.2.1], [1.2.2], [1.2.3], [1.2.4], [1.2.5].

Full detail: CHANGELOG.md (1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.5).

2026-09-22 15:24:52 +03:00