7 Commits

Include renames

Author	SHA1	Message	Date
mixandCursor	02afa0fa80	fix(panel): code-review P6 optional cleanup ... Close the remaining low-risk items from the full-tree review: rename the settings handler, query assigned domains in SQL, bound the login limiter map, collapse panel.js show/hide helpers, and soften DMARC copy that promised a future in-panel receiver. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-08-14 14:48:43 +03:00
3 people	e6af1a7866	test: cover the auth, sign-in and RBAC surfaces P0 shipped through (P4) ... - internal/web/auth/ratelimit_test.go: the login/setup limiter's ceiling, per-address scope, window reset and the sweep that keeps finished buckets out of memory. - internal/web/auth/handlers_test.go: sign-in (session issued, refusals that do not reveal which usernames exist, a lockout a correct password cannot bypass, the setup hint before the first administrator) and the one-time setup link (creates the first global administrator and then closes, rejects a wrong or expired token, refuses credentials the panel would not accept later, rate-limited). - internal/web/handlers/authz_test.go: every global-only route answers a domain administrator — and a request with no principal — with 404, with a positive control so the table cannot pass on a handler that always 404s. This is the check that would have caught the send-log leak. - test/e2e: CoreDNS pinned to 1.14.6 instead of latest; the level-1 failure message quoted RATE_LIMIT_MESSAGES_PER_IP=5 while the stand sets 50. docs/plans/code-review.md P4 checked off except the optional backup-boot test; CHANGELOG updated. No production code changed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-08-13 23:35:46 +03:00
3 people	1cf8bfcbe2	docs: rewrite security/operator docs for the multi-user panel (P2) ... The CSRF ADR, guide.md, architecture.md route table, the internal/backup package comment, roadmap/dmarc-reports admin.dmarc_report_email references, the e2e coverage summary, and the setupManager/store package comments still described the pre-1.2.0 single-administrator panel or stale implementation details. Closes P2 of docs/plans/code-review.md; no behaviour change. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-08-13 16:15:14 +03:00
3 people	4761991dd5	panel,mail: fail closed on the rate-limit race, session create and app delete ... The level-2 limiter counted stored plus in-flight messages and reserved its own slot in two critical sections, so SMTP sessions that overlapped could each take the last free slot; tryAdmit now does both under one lock. A session that cannot be written no longer yields a cookie the browser would carry while every request bounced to /login. Deleting an application clears its SASL account before its registry row, matching domain delete, so a saslpasswd2 failure leaves a retryable application rather than an account that still authenticates. Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-08-13 14:50:04 +03:00
mixandCursor	a1e7e05d26	ci: gofmt files that failed the formatting workflow check ... Whitespace-only alignment from gofmt; removes a stray BOM in web.go. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-08-13 12:24:34 +03:00
mixandCursor	15baa1e5d0	feat(panel): add domain-admin role with per-domain authorization ... Co-authored-by: Cursor <cursoragent@cursor.com>	2026-08-10 23:43:59 +03:00
mixandCursor	155b721438	Split internal/web into subpackages before domain-admin growth. ... Lay out view, auth, validate, and handlers under internal/web while keeping the cmd/panel API unchanged; update roadmap and changelog for web-split closure. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-08-10 23:19:09 +03:00