mixandClaude Opus 5.5
3b86f6c3b6
Stage 1, step 2 (plan § Who sees what).
Store
- Reach{AllDomains, DomainIDs, AllInbound, InboundDomainIDs} is what a
domain user is assigned. CreateUser takes it; SetUserReach / ClearUserReach
replace SetUserDomains / ClearUserDomains and write both directions in one
transaction. A domain user with nothing on either list is refused
(ErrEmptyReach). With All set the rows of that direction are not stored,
so clearing All later brings nothing stale back.
- ListDomainsForUser honours all_domains; ListInboundDomainsForUser is its
inbound twin. Both filter in the query.
Authorization
- auth.Principal carries the whole reach: CanAccessDomain (now also true
with All), CanAccessInboundDomain, HasOutbound, HasInbound. An id or a
name on one list opens nothing on the other.
- Inbound handlers in three strengths: requireInbound (the list, filtered),
requireInboundDomain (one domain: page, DNS re-check, upstream,
recipients), requireInboundGlobal (add, delete confirm, delete). All
answer the same 404.
- domainIDSet and the DMARC report pages go through the principal instead
of looking at p.Domains themselves.
Panel (old templates, until stage 2)
- User form: two lists with All; inbound is offered only where the feature
is on, and saving the form with it off keeps the user's inbound reach.
Promotion to global drops the reach.
- Menu: a group with nothing assigned is absent; / sends an inbound-only
administrator to Inbound. The inbound pages hide add / delete from a
domain administrator.
Tests: every route of one inbound domain against five kinds of refused
request (another tenant's id, a missing id, outbound-only reach, an outbound
domain with the same id, one with the same name, no principal) with the 404
bodies compared; add/delete as every non-global user; the filtered list
including a domain added later; thirteen outbound routes against another
tenant's domain and application id; the user form; the reach in the store;
the principal matrix; the menu; the home redirect. Removing the access check
or the query filter makes the tests fail (checked by hand).
go test ./... green except the two Windows-only failures in internal/domain
and internal/logtail that predate this work.
Roadmap 12/27.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
55 lines
2.0 KiB
HTML
55 lines
2.0 KiB
HTML
{{define "wide"}}wide{{end}}
|
|
|
|
{{define "content"}}
|
|
<h1>Inbound</h1>
|
|
|
|
<p class="muted">Backup-MX / forwarder. Accepts on port 25 only for listed
|
|
domains. Recipients are either an allow-list or any address at that domain.
|
|
Off by default in Compose.</p>
|
|
|
|
{{if .Flash}}<div class="flash">{{.Flash}}</div>{{end}}
|
|
|
|
<div class="card">
|
|
<h2>Forwarding</h2>
|
|
{{/* Adding and deleting a domain stay with the global role; a domain
|
|
administrator works with the inbound domains assigned to them. */}}
|
|
{{if .IsGlobal}}
|
|
<form method="post" action="/inbound">
|
|
<label for="name">Add inbound domain</label>
|
|
<div class="input-row">
|
|
<input id="name" name="name" type="text" placeholder="lists.example.com"
|
|
autocomplete="off" autocapitalize="none" spellcheck="false"
|
|
value="{{.FormName}}" autofocus required>
|
|
<button type="submit">Add domain</button>
|
|
</div>
|
|
{{if .Error}}<p class="error">{{.Error}}</p>{{end}}
|
|
</form>
|
|
{{end}}
|
|
{{if .Domains}}
|
|
<table>
|
|
<thead>
|
|
<tr><th>Domain</th><th>DNS</th><th>Upstream</th><th>Recipients</th><th>TLS</th><th></th></tr>
|
|
</thead>
|
|
<tbody>
|
|
{{range .Domains}}
|
|
<tr>
|
|
<td><a href="/inbound/{{.ID}}">{{.Name}}</a></td>
|
|
<td><a class="st st-{{.DNS}}" href="/inbound/{{.ID}}">{{.DNS}}</a></td>
|
|
<td class="muted">{{.Upstream}}</td>
|
|
<td>{{.RcptLabel}}</td>
|
|
<td><span class="st st-{{if eq .TLSMode "encrypt"}}ok{{else}}unknown{{end}}">{{.TLSLabel}}</span></td>
|
|
<td class="actions">{{if $.IsGlobal}}<a class="danger" href="/inbound/{{.ID}}/delete">Delete</a>{{end}}</td>
|
|
</tr>
|
|
{{end}}
|
|
</tbody>
|
|
</table>
|
|
<p class="muted">The <em>DNS</em> badge is the MX check: at least one MX must
|
|
point at this server. Results are cached for a few minutes; open a domain for
|
|
the lookup and a <em>Re-check</em> button.</p>
|
|
{{else}}
|
|
<p class="muted">No inbound domains yet. Add one above, then set the upstream
|
|
on its page. Mail is not accepted until an upstream host is saved.</p>
|
|
{{end}}
|
|
</div>
|
|
{{end}}
|