mixandClaude Opus 5.5
f09b60aaa2
test / test (push) Canceled after 0s
Neither review (read-only agents, Opus and Fable, over 972a9f8..400aa76) has a Critical finding. Both found the same serious one, and more: - The notification about refused mail was built on what a rejected row says of itself. Its domain is the one in MAIL FROM, which the client typed and Postfix has not yet held against the login when the milter refuses: an application over its limit could have had the panel write a message per made-up domain, to another tenant's users among others. And the same status is written when an application is refused for its client address, which is no limit. Refusals are now counted by the domain the login is registered under, only for logins that exist and only while a limit is set on the login or its domain; one subject per sending domain. They are read through a partial index of their own (migration 0005): the query walked the whole send log every minute. - Account and user e-mails were checked with the DMARC report validator, which refuses Gmail and the like - the owner's own kind of address. A new validate.AccountEmail accepts them and refuses a local part beginning "-". - "Said" now means sent: what arises while nobody can be told, or while Postfix does not take the message, is told at a later check. Its ending with nobody left to tell is simply over. - Two DNS checks must be 45 minutes apart as well as two: the last check before a restart and the first after it were minutes apart. - The notifier's own mail waiting in the queue, and its bounce coming back to postmaster@ this server, are not the queue's subject. A listing cut at its size limit or with a line too long to read is no listing; postqueue -j gets 30 seconds. - The tables must name the selector the panel shows, not only have the line. - An a/mx lookup that did not answer inside the SPF check made the record "not authorising"; it is "cannot tell" now, for the pages too. - A ceiling of 60 messages an hour; a pass stops between domains when the process is asked to stop; sendmail gets a WaitDelay; days are rounded as a person counts; a failed read of the switch shows it on, not off. Recorded as accepted in security.md, with a roadmap candidate (from-header-binding): an application can have a message signed as the server's own name - or, as always, as another registered domain - by writing it into the From: header, which nothing holds against the login. Left as found: a recipient whose copy failed while another's went out is not tried again; a certificate that lives under 14 days is reported at each renewal. On the test server, for this tree: go vet clean, go test ./... 23 packages ok, make e2e ok (326 s). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
30 lines
1.4 KiB
SQL
30 lines
1.4 KiB
SQL
-- Notifications: the panel writes to its users when something needs them
|
|
-- (panel-notifications, 2.3.0). DDL only; nothing existing changes, and every
|
|
-- user starts with notifications on.
|
|
|
|
-- A user's own switch, on Account. It decides nothing by itself: a user is
|
|
-- written to when it is on, the profile has an e-mail and the instance switch
|
|
-- (settings key "notifications") is on.
|
|
ALTER TABLE users ADD COLUMN notify INTEGER NOT NULL DEFAULT 1 CHECK (notify IN (0, 1));
|
|
|
|
-- What the panel has already said, so that it says each thing once and a
|
|
-- restart announces nothing again. One row per subject:
|
|
-- dns:<domain> a sending domain's records
|
|
-- cert the TLS certificate
|
|
-- queue a message older than three days
|
|
-- limit:<domain> level-2 limits that refused mail of the domain
|
|
-- phase is where the subject stands ("pending": seen wrong, not yet said;
|
|
-- "open": said; for the certificate, the threshold last said). count is the
|
|
-- checks in a row that agree with the phase's direction, mark what the phase
|
|
-- refers to (the certificate's expiry; for DNS, when the records were first
|
|
-- seen right again), since when it began, sent_at when the last message about
|
|
-- it went out.
|
|
CREATE TABLE notify_state (
|
|
key TEXT PRIMARY KEY,
|
|
phase TEXT NOT NULL,
|
|
count INTEGER NOT NULL DEFAULT 0,
|
|
mark TEXT NOT NULL DEFAULT '',
|
|
since TEXT NOT NULL,
|
|
sent_at TEXT NOT NULL DEFAULT ''
|
|
);
|