mixandClaude Opus 5.5
ef18ef21a0
test / test (push) Canceled after 0s
Technical review (Opus) and security review (Fable) of a59e3d4..cb5a4a2;
reports in the session's scratchpad. Nothing critical, high or medium; no
outright bug. Fixed:
- F2, F3 (0008 backfill, before it runs on the live database): rows are
filled by the rule new rows follow - the application's domain, then the
name's - and only by a domain and application that existed when the row
was written (created_at); the inbound log likewise. Test: the migration's
UPDATEs re-run on prepared rows (before the domain, after, null sender,
application gone, a stranger's name). Dry run on a copy of the live
database: 68/68 and 10/10 rows filled, none disagreeing with its login's
domain, integrity ok.
- V2, F4: an application's statistics and level-2 count are its login's
rows of its domain (appByLogin), and StatsWindow starts no earlier than
the entity's creation; the message page's "may send as" only for a login
still of the row's domain. Test: a login taken again in another domain
starts at zero.
- F7: MAIL FROM:<> is held to the domain limit of its login
(ApplicationByLogin fills DomainName).
- V3: an imported DKIM selector is held to DNS labels (validate.Selector).
- F5, F6: an imported auto limit's numbers are dropped and recalculated
right after the import; its mode is stored trimmed.
- V6: the store refuses a role that is neither global nor domain.
- F9: SaveUser keeps the stored hash when no new password is given (the
form no longer writes back the hash it read). F10: a reach naming a
domain deleted meanwhile is ErrNoSuchDomain, answered on the form.
- V4, F12: from-lines-other.txt - lines naming another sender ({other}) in
a quoted string, a quoted pair, capitals, a comment, an encoded word, a
quoted local part; the unit test wants each refused, the e2e
(lines_naming_another_sender_never_signed_for_it) wants each refused and
none signed for it. The passed list gained a.{DOMAIN}, a comment after
the angle address, a quoted local part, and "b@ {other}" - passed by
design (security.md), and the e2e shows it signed for the own domain.
- F13: e2e login_in_other_capitals_does_not_authenticate - AUTH with the
login upper-cased gets 535.
Not changed, written down: V1/F1 - L8 is half closed (refused or passed
still tells an application which domains are hosted here); security.md's
accepted risks and the CHANGELOG say so, and the owner is asked whether to
refuse every foreign address in a display name (changes the 2.4.0 rule).
F11 - deleting a domain rewrites its rows' domain_id (seconds at 1e5 rows),
accepted at this size. F8 (test cannot tell write-first from read-first;
the reviewer verified it with two stores, 30/30), V5, V7, P2: noted.
Evidence on the test server for this tree: go vet clean, go test ./... 23
packages ok, make e2e exit 0 with the three new cases.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
42 lines
2.7 KiB
SQL
42 lines
2.7 KiB
SQL
-- The tenant boundary (audit 2026-10-12, stage 2).
|
|
|
|
-- An application login is unique without regard to case. Postfix compares
|
|
-- the SASL login with the sender map's without regard to case, so "Ops" and
|
|
-- "ops" were two applications to the panel and one sender to Postfix: a
|
|
-- tenant could take another's envelope sender (audit H4). New logins are
|
|
-- folded to lower case by the panel; a login stored earlier keeps its case,
|
|
-- since its SASL account and its client use it. The column's own UNIQUE
|
|
-- (case-sensitive) stays: SQLite cannot change a column's collation without
|
|
-- rebuilding the table, and this index is the stricter rule.
|
|
CREATE UNIQUE INDEX idx_applications_login_nocase ON applications (login COLLATE NOCASE);
|
|
|
|
-- A send-log row belongs to a domain by its id, not its name (audit L12; the
|
|
-- owner, 2026-10-12). A domain deleted and added again under its old name
|
|
-- used to show the earlier rows to whoever it was assigned to next. The id is
|
|
-- the domain of the login the row was written for; a row of a domain deleted
|
|
-- since - and every row older than this migration whose domain is gone - is
|
|
-- NULL and nobody's but the global role's. The name stays for display and for
|
|
-- the global view.
|
|
--
|
|
-- Filled once, by the rule new rows follow: the domain of the row's
|
|
-- application, then - for a row whose application is gone - the domain of the
|
|
-- row's name. Either only if it already existed when the row was written: a
|
|
-- domain deleted and added again before this migration must not inherit the
|
|
-- rows of the one before (review of audit stage 2). Times are RFC3339 UTC
|
|
-- text, so they compare as times.
|
|
ALTER TABLE send_log ADD COLUMN domain_id INTEGER REFERENCES domains(id) ON DELETE SET NULL;
|
|
UPDATE send_log SET domain_id = COALESCE(
|
|
(SELECT a.domain_id FROM applications a JOIN domains d ON d.id = a.domain_id
|
|
WHERE a.login = send_log.app_login
|
|
AND a.created_at <= send_log.created_at AND d.created_at <= send_log.created_at),
|
|
(SELECT d.id FROM domains d
|
|
WHERE d.name = send_log.domain AND d.created_at <= send_log.created_at));
|
|
CREATE INDEX idx_send_log_domain_id_created_at ON send_log (domain_id, created_at);
|
|
|
|
-- The inbound journal follows the same rule, so the two logs do not follow two
|
|
-- (security.md's accepted risk of the inbound log, struck).
|
|
ALTER TABLE inbound_spam_log ADD COLUMN inbound_domain_id INTEGER REFERENCES inbound_domains(id) ON DELETE SET NULL;
|
|
UPDATE inbound_spam_log SET inbound_domain_id = (SELECT d.id FROM inbound_domains d
|
|
WHERE d.name = inbound_spam_log.inbound_domain AND d.created_at <= inbound_spam_log.created_at);
|
|
CREATE INDEX idx_inbound_spam_log_domain_id_created_at ON inbound_spam_log (inbound_domain_id, created_at);
|