test / test (push) Canceled after 0s
Technical review (Opus) and security review (Fable) of a59e3d4..cb5a4a2;
reports in the session's scratchpad. Nothing critical, high or medium; no
outright bug. Fixed:
- F2, F3 (0008 backfill, before it runs on the live database): rows are
filled by the rule new rows follow - the application's domain, then the
name's - and only by a domain and application that existed when the row
was written (created_at); the inbound log likewise. Test: the migration's
UPDATEs re-run on prepared rows (before the domain, after, null sender,
application gone, a stranger's name). Dry run on a copy of the live
database: 68/68 and 10/10 rows filled, none disagreeing with its login's
domain, integrity ok.
- V2, F4: an application's statistics and level-2 count are its login's
rows of its domain (appByLogin), and StatsWindow starts no earlier than
the entity's creation; the message page's "may send as" only for a login
still of the row's domain. Test: a login taken again in another domain
starts at zero.
- F7: MAIL FROM:<> is held to the domain limit of its login
(ApplicationByLogin fills DomainName).
- V3: an imported DKIM selector is held to DNS labels (validate.Selector).
- F5, F6: an imported auto limit's numbers are dropped and recalculated
right after the import; its mode is stored trimmed.
- V6: the store refuses a role that is neither global nor domain.
- F9: SaveUser keeps the stored hash when no new password is given (the
form no longer writes back the hash it read). F10: a reach naming a
domain deleted meanwhile is ErrNoSuchDomain, answered on the form.
- V4, F12: from-lines-other.txt - lines naming another sender ({other}) in
a quoted string, a quoted pair, capitals, a comment, an encoded word, a
quoted local part; the unit test wants each refused, the e2e
(lines_naming_another_sender_never_signed_for_it) wants each refused and
none signed for it. The passed list gained a.{DOMAIN}, a comment after
the angle address, a quoted local part, and "b@ {other}" - passed by
design (security.md), and the e2e shows it signed for the own domain.
- F13: e2e login_in_other_capitals_does_not_authenticate - AUTH with the
login upper-cased gets 535.
Not changed, written down: V1/F1 - L8 is half closed (refused or passed
still tells an application which domains are hosted here); security.md's
accepted risks and the CHANGELOG say so, and the owner is asked whether to
refuse every foreign address in a display name (changes the 2.4.0 rule).
F11 - deleting a domain rewrites its rows' domain_id (seconds at 1e5 rows),
accepted at this size. F8 (test cannot tell write-first from read-first;
the reviewer verified it with two stores, 30/30), V5, V7, P2: noted.
Evidence on the test server for this tree: go vet clean, go test ./... 23
packages ok, make e2e exit 0 with the three new cases.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
121 lines
4.1 KiB
Go
121 lines
4.1 KiB
Go
package store
|
|
|
|
import (
|
|
"fmt"
|
|
"math"
|
|
"time"
|
|
)
|
|
|
|
// StatsWindowDays is the rolling window for send statistics on the domain page.
|
|
const StatsWindowDays = 30
|
|
|
|
// SendStats holds message-volume metrics over a stats window (guide § Rate
|
|
// limiting — same counting rules as CountMessages).
|
|
type SendStats struct {
|
|
Total int64
|
|
PeakPerHour int64
|
|
AvgPerHour float64
|
|
WindowDays int // actual days queried (min(30, retention))
|
|
WindowHours float64 // hours used for the average-rate denominator
|
|
}
|
|
|
|
// StatsWindow computes the since timestamp and hours denominator for send
|
|
// statistics. The query window is min(30, retention) days; hours_in_window is
|
|
// min(720, entity age in hours, retention hours).
|
|
func StatsWindow(retentionDays int, entityCreated time.Time) (since time.Time, hours float64, windowDays int) {
|
|
if retentionDays <= 0 {
|
|
retentionDays = SendLogRetentionDaysDefault
|
|
}
|
|
windowDays = StatsWindowDays
|
|
if retentionDays < StatsWindowDays {
|
|
windowDays = retentionDays
|
|
}
|
|
since = time.Now().UTC().AddDate(0, 0, -windowDays)
|
|
|
|
retentionHours := float64(retentionDays) * 24
|
|
ageHours := time.Since(entityCreated).Hours()
|
|
if ageHours < 0 {
|
|
ageHours = 0
|
|
}
|
|
|
|
hours = math.Min(720, math.Min(ageHours, retentionHours))
|
|
if hours < 1 {
|
|
hours = 1
|
|
}
|
|
// Nothing before the entity was created is its own: rows from then are a
|
|
// predecessor's of the same name or login (review of audit stage 2).
|
|
if c := entityCreated.UTC(); c.After(since) {
|
|
since = c
|
|
}
|
|
return since, hours, windowDays
|
|
}
|
|
|
|
// DomainSendStats returns 30-day (or shorter when retention is lower) send
|
|
// statistics for a domain, named by its name: the rows that belong to the
|
|
// domain registered under it now (audit 2026-10-12, L12).
|
|
func (s *Store) DomainSendStats(name string, retentionDays int, createdAt time.Time) (SendStats, error) {
|
|
since, hours, windowDays := StatsWindow(retentionDays, createdAt)
|
|
stats, err := s.sendStats(domainByName, name, since, hours)
|
|
if err != nil {
|
|
return SendStats{}, err
|
|
}
|
|
stats.WindowDays = windowDays
|
|
stats.WindowHours = hours
|
|
return stats, nil
|
|
}
|
|
|
|
// AppSendStats returns send statistics for an application login.
|
|
func (s *Store) AppSendStats(login string, retentionDays int, createdAt time.Time) (SendStats, error) {
|
|
since, hours, windowDays := StatsWindow(retentionDays, createdAt)
|
|
stats, err := s.sendStats(appByLogin, login, since, hours)
|
|
if err != nil {
|
|
return SendStats{}, err
|
|
}
|
|
stats.WindowDays = windowDays
|
|
stats.WindowHours = hours
|
|
return stats, nil
|
|
}
|
|
|
|
// domainByName selects a domain's send-log rows by the id of the domain
|
|
// registered under the name it is given.
|
|
const domainByName = "domain_id = (SELECT d.id FROM domains d WHERE d.name = ?)"
|
|
|
|
// appByLogin selects an application's send-log rows: its login's rows of its
|
|
// domain. A login is unique while it exists, but a deleted application's
|
|
// login can be taken again in another domain, and its numbers - statistics,
|
|
// the level-2 count - must not start with the old one's (review of audit
|
|
// stage 2). ?1 twice; a plain ? after it takes the next number.
|
|
const appByLogin = "app_login = ?1 AND domain_id = (SELECT a.domain_id FROM applications a WHERE a.login = ?1)"
|
|
|
|
// sendStats counts the rows that match, a condition with one placeholder
|
|
// taking ref.
|
|
func (s *Store) sendStats(match, ref string, since time.Time, hours float64) (SendStats, error) {
|
|
sinceStr := since.UTC().Format(time.RFC3339)
|
|
|
|
var total int64
|
|
err := s.db.QueryRow(
|
|
`SELECT COUNT(DISTINCT queue_id) FROM send_log
|
|
WHERE `+match+` AND status != ? AND created_at >= ?`,
|
|
ref, StatusRejected, sinceStr,
|
|
).Scan(&total)
|
|
if err != nil {
|
|
return SendStats{}, fmt.Errorf("send stats total %q: %w", ref, err)
|
|
}
|
|
|
|
var peak int64
|
|
err = s.db.QueryRow(
|
|
`SELECT COALESCE(MAX(bucket_count), 0) FROM (
|
|
SELECT COUNT(DISTINCT queue_id) AS bucket_count FROM send_log
|
|
WHERE `+match+` AND status != ? AND created_at >= ?
|
|
GROUP BY substr(created_at, 1, 13)
|
|
)`,
|
|
ref, StatusRejected, sinceStr,
|
|
).Scan(&peak)
|
|
if err != nil {
|
|
return SendStats{}, fmt.Errorf("send stats peak %q: %w", ref, err)
|
|
}
|
|
|
|
avg := float64(total) / hours
|
|
return SendStats{Total: total, PeakPerHour: peak, AvgPerHour: avg}, nil
|
|
}
|