mixandClaude Opus 5.5
f51f5db245
Postfix's reject_sender_login_mismatch compares the SASL login with the sender map without regard to case - seen on the e2e stand this time (a one-off probe, not committed: map rewritten to "APP1", client authenticated as "app1", RCPT accepted). The panel stored logins as typed under a BINARY UNIQUE, so "Ops" and "ops" were two applications to the panel and one sender to Postfix: a tenant could send with another tenant's envelope sender. - app.foldLogin: Service.Create lower-cases the login (owner: fold, do not refuse); CreateWithSettings rolls back the stored (folded) login. - ImportApplication keeps the login as written: folding it would rename the SASL account and break the imported application's working credentials; the index below refuses a case clash there too. - Migration 0008 (DDL): CREATE UNIQUE INDEX idx_applications_login_nocase ON applications (login COLLATE NOCASE). The column's own BINARY UNIQUE stays (SQLite cannot change a collation without a table rebuild, which a migration transaction cannot do with foreign keys on). Checked on the live installation first: 4 logins, no case clash; "Quieter3C" keeps its case. 0008 is not run anywhere yet; send_log.domain_id joins it later in stage 2. Tests: "Ops" created as ops, SASL account and map binding in lower case, OPS in another domain and an imported oPs refused; the store refuses ops beside Ops; schema at user_version 8 with the index. CHANGELOG [Unreleased], audit plan line ticked, roadmap 15/61. Evidence on the test server for this tree (with the probe): go vet clean, go test ./... 23 packages ok, make e2e exit 0. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
12 lines
731 B
SQL
12 lines
731 B
SQL
-- The tenant boundary (audit 2026-10-12, stage 2).
|
|
|
|
-- An application login is unique without regard to case. Postfix compares
|
|
-- the SASL login with the sender map's without regard to case, so "Ops" and
|
|
-- "ops" were two applications to the panel and one sender to Postfix: a
|
|
-- tenant could take another's envelope sender (audit H4). New logins are
|
|
-- folded to lower case by the panel; a login stored earlier keeps its case,
|
|
-- since its SASL account and its client use it. The column's own UNIQUE
|
|
-- (case-sensitive) stays: SQLite cannot change a column's collation without
|
|
-- rebuilding the table, and this index is the stricter rule.
|
|
CREATE UNIQUE INDEX idx_applications_login_nocase ON applications (login COLLATE NOCASE);
|