mix
7b8685d038
Application sending controls: client IP allow-list for authorization, and level-2 rate limits that override the domain ceiling per application. Added: - Per-application **client IP allow-list** on the domain page: when enabled, - SQLite migration `0009_application_auth_ips.sql` (moves legacy trusted IPs Changed: - Application level-2 rate limit **overrides** the domain limit for that login - Domain export/import carries `auth_ip_restrict` / `auth_allowed_ips`; legacy - Panel help, Settings, and [guide.md](docs/guide.md) describe override semantics - [guide.md](docs/guide.md): full-backup section documents all four capture Full detail: CHANGELOG.md (1.9.0).
23 lines
885 B
SQL
23 lines
885 B
SQL
-- Client IP restriction for application SASL authorization (independent of
|
|
-- level-2 rate limits). When enabled, only listed IPs may submit mail as the
|
|
-- application; when disabled, any client IP is allowed.
|
|
|
|
ALTER TABLE applications ADD COLUMN auth_ip_restrict INTEGER NOT NULL DEFAULT 0;
|
|
ALTER TABLE applications ADD COLUMN auth_allowed_ips TEXT;
|
|
|
|
-- Migrate trusted IPs from application rate_limits into auth_allowed_ips.
|
|
UPDATE applications
|
|
SET auth_ip_restrict = 1,
|
|
auth_allowed_ips = (
|
|
SELECT allowed_ips FROM rate_limits
|
|
WHERE scope = 'application' AND ref_id = applications.id
|
|
)
|
|
WHERE EXISTS (
|
|
SELECT 1 FROM rate_limits
|
|
WHERE scope = 'application' AND ref_id = applications.id
|
|
AND allowed_ips IS NOT NULL AND TRIM(allowed_ips) != ''
|
|
);
|
|
|
|
UPDATE rate_limits SET allowed_ips = NULL
|
|
WHERE scope = 'application' AND allowed_ips IS NOT NULL;
|