test / test (push) Canceled after 0s
Technical review (Opus) and security review (Fable) of a59e3d4..cb5a4a2;
reports in the session's scratchpad. Nothing critical, high or medium; no
outright bug. Fixed:
- F2, F3 (0008 backfill, before it runs on the live database): rows are
filled by the rule new rows follow - the application's domain, then the
name's - and only by a domain and application that existed when the row
was written (created_at); the inbound log likewise. Test: the migration's
UPDATEs re-run on prepared rows (before the domain, after, null sender,
application gone, a stranger's name). Dry run on a copy of the live
database: 68/68 and 10/10 rows filled, none disagreeing with its login's
domain, integrity ok.
- V2, F4: an application's statistics and level-2 count are its login's
rows of its domain (appByLogin), and StatsWindow starts no earlier than
the entity's creation; the message page's "may send as" only for a login
still of the row's domain. Test: a login taken again in another domain
starts at zero.
- F7: MAIL FROM:<> is held to the domain limit of its login
(ApplicationByLogin fills DomainName).
- V3: an imported DKIM selector is held to DNS labels (validate.Selector).
- F5, F6: an imported auto limit's numbers are dropped and recalculated
right after the import; its mode is stored trimmed.
- V6: the store refuses a role that is neither global nor domain.
- F9: SaveUser keeps the stored hash when no new password is given (the
form no longer writes back the hash it read). F10: a reach naming a
domain deleted meanwhile is ErrNoSuchDomain, answered on the form.
- V4, F12: from-lines-other.txt - lines naming another sender ({other}) in
a quoted string, a quoted pair, capitals, a comment, an encoded word, a
quoted local part; the unit test wants each refused, the e2e
(lines_naming_another_sender_never_signed_for_it) wants each refused and
none signed for it. The passed list gained a.{DOMAIN}, a comment after
the angle address, a quoted local part, and "b@ {other}" - passed by
design (security.md), and the e2e shows it signed for the own domain.
- F13: e2e login_in_other_capitals_does_not_authenticate - AUTH with the
login upper-cased gets 535.
Not changed, written down: V1/F1 - L8 is half closed (refused or passed
still tells an application which domains are hosted here); security.md's
accepted risks and the CHANGELOG say so, and the owner is asked whether to
refuse every foreign address in a display name (changes the 2.4.0 rule).
F11 - deleting a domain rewrites its rows' domain_id (seconds at 1e5 rows),
accepted at this size. F8 (test cannot tell write-first from read-first;
the reviewer verified it with two stores, 30/30), V5, V7, P2: noted.
Evidence on the test server for this tree: go vet clean, go test ./... 23
packages ok, make e2e exit 0 with the three new cases.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
94 lines
3.6 KiB
Go
94 lines
3.6 KiB
Go
package store
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
// backfill0008 runs the UPDATE statements of migration 0008 again: the store
|
|
// is already at its head, so the rows a test prepares get the backfill as
|
|
// they would have on an upgrade.
|
|
func backfill0008(t *testing.T, st *Store) {
|
|
t.Helper()
|
|
raw, err := migrationsFS.ReadFile("migrations/0008_tenant_boundary.sql")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
var lines []string
|
|
for _, l := range strings.Split(string(raw), "\n") {
|
|
if !strings.HasPrefix(strings.TrimSpace(l), "--") {
|
|
lines = append(lines, l)
|
|
}
|
|
}
|
|
for _, stmt := range strings.Split(strings.Join(lines, "\n"), ";") {
|
|
if strings.HasPrefix(strings.TrimSpace(stmt), "UPDATE") {
|
|
if _, err := st.db.Exec(stmt); err != nil {
|
|
t.Fatalf("%s: %v", stmt, err)
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
// The backfill follows the rule new rows follow - the application's domain,
|
|
// then the domain of the row's name - and gives a row only to a domain that
|
|
// already existed when it was written (review of audit stage 2).
|
|
func TestBackfillOf0008(t *testing.T) {
|
|
st := openTestStore(t)
|
|
d := addTestDomain(t, st, "a.example")
|
|
if _, err := st.AddApplication(d.ID, "shop", AddressModeWildcard, nil); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
in, err := st.AddInboundDomain("in.example")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
// The domain, its application and the inbound domain were created on 1 Oct.
|
|
for _, q := range []string{
|
|
`UPDATE domains SET created_at = '2026-10-01T00:00:00Z'`,
|
|
`UPDATE applications SET created_at = '2026-10-01T00:00:00Z'`,
|
|
`UPDATE inbound_domains SET created_at = '2026-10-01T00:00:00Z'`,
|
|
} {
|
|
if _, err := st.db.Exec(q); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
rows := []struct{ queue, domain, login, at string }{
|
|
{"BEFORE", "a.example", "shop", "2026-09-01T00:00:00Z"}, // a predecessor's: nobody's
|
|
{"AFTER", "a.example", "shop", "2026-10-02T00:00:00Z"}, // the application's
|
|
{"NULLSENDER", "", "shop", "2026-10-02T00:00:00Z"}, // no domain of its own: the application's
|
|
{"GONEAPP", "a.example", "gone", "2026-10-02T00:00:00Z"}, // the application is gone: by name
|
|
{"STRANGER", "b.example", "gone", "2026-10-02T00:00:00Z"},
|
|
}
|
|
for _, r := range rows {
|
|
if _, err := st.db.Exec(`INSERT INTO send_log (queue_id, domain, app_login, from_addr, to_addr, subject, status, created_at, updated_at)
|
|
VALUES (?, ?, ?, '', 'x@example.net', '', 'sent', ?, ?)`, r.queue, r.domain, r.login, r.at, r.at); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
for _, at := range []string{"2026-09-01T00:00:00Z", "2026-10-02T00:00:00Z"} {
|
|
if _, err := st.db.Exec(`INSERT INTO inbound_spam_log (inbound_domain, client_ip, from_addr, to_addr, subject, decision, engine, detail, created_at)
|
|
VALUES ('in.example', '203.0.113.7', 's@x', 'r@in.example', '', 'accept', 'rspamd', '', ?)`, at); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
|
|
backfill0008(t, st)
|
|
|
|
want := map[string]int64{"BEFORE": 0, "AFTER": d.ID, "NULLSENDER": d.ID, "GONEAPP": d.ID, "STRANGER": 0}
|
|
for queue, id := range want {
|
|
var got int64
|
|
if err := st.db.QueryRow(`SELECT COALESCE(domain_id, 0) FROM send_log WHERE queue_id = ?`, queue).Scan(&got); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if got != id {
|
|
t.Errorf("%s: domain_id %d, want %d", queue, got, id)
|
|
}
|
|
}
|
|
var before, after int64
|
|
st.db.QueryRow(`SELECT COALESCE(inbound_domain_id, 0) FROM inbound_spam_log WHERE created_at = '2026-09-01T00:00:00Z'`).Scan(&before)
|
|
st.db.QueryRow(`SELECT COALESCE(inbound_domain_id, 0) FROM inbound_spam_log WHERE created_at = '2026-10-02T00:00:00Z'`).Scan(&after)
|
|
if before != 0 || after != in.ID {
|
|
t.Errorf("inbound rows: before %d, after %d; want 0 and %d", before, after, in.ID)
|
|
}
|
|
}
|