mixandClaude Opus 5.5
8d1af89e1a
Stage 1, step 1. BREAKING: a 1.x database is not migrated.
Schema
- internal/store/migrations/ holds one file, 0001_init.sql, equal to the
2.0 schema; 0002..0010 are deleted (they stay in history at 1.9.5). No
admin table created and dropped, no ALTERs.
- users.email replaces users.dmarc_report_email: the address is the
user's own. The default DMARC report address is a user's setting
(dmarc_default_mode hosted/account/custom/none, dmarc_default_address);
the instance setting that mirrored the global user's field is gone.
- domains.dmarc_rua_user_id: a domain follows a named user's default, or
has an address of its own in dmarc_rua ('' = none). ON DELETE SET NULL
leaves it at "no reports", never at someone else's default.
- user_inbound_domains, users.all_domains, users.all_inbound_domains: in
the schema for the inbound delegation of the next step.
- users.role is 'global' / 'domain' (was 'domain_admin');
rate_limits.allowed_ips, unused since 1.9.0, is dropped.
Opening a database
- The baseline sets PRAGMA application_id ("SP20"). store.Open refuses a
file that has a schema version without it (ErrForeignSchema) and one
newer than the build. A 1.x file at user_version 10 would otherwise read
as already migrated. The refused file is left untouched.
Code
- Store.DomainDMARCRua is the one place a domain's report address is
resolved; dnscheck.ResolveDMARCRua and Store.GlobalDMARCReportEmail are
gone. dmarc.AllowedRecipients, the domain page, the dashboard and the
DNS re-check go through it.
- The old templates keep working on the new model until their pages are
restyled: the Settings form's address field is the account e-mail and
switches the user's default between it and none; a domain's "Same as
Settings" makes it follow the user who chose it; a new or imported
domain follows its creator.
- Domain export/import: a domain that follows a user exports no address.
Tests: the baseline pinned table by table (TestBaselineSchema), refusal of a
1.x and of a newer database, constraints and cascades of the new columns and
table, resolution in every default mode, the deleted-user case, and the three
bridged handlers.
docs/schema-migrations.md is rewritten for the baseline; roadmap 11/27,
schema-squash marked built.
go test ./... (Windows)
ok for every package except two that fail the same way before this commit:
internal/domain TestWriteLoadPrivateKeyRoundtrip (file mode on NTFS)
internal/logtail TestFollowTailsAndRotates (rename of an open file)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
87 lines
2.0 KiB
Go
87 lines
2.0 KiB
Go
package auth
|
|
|
|
import (
|
|
"context"
|
|
"net/http"
|
|
|
|
"github.com/mixeme/selfpost/internal/store"
|
|
)
|
|
|
|
type ctxKey int
|
|
|
|
const (
|
|
usernameKey ctxKey = 0
|
|
principalKey ctxKey = 1
|
|
)
|
|
|
|
// Role is a panel user's access level.
|
|
type Role = store.Role
|
|
|
|
const (
|
|
RoleGlobal = store.RoleGlobal
|
|
RoleDomain = store.RoleDomain
|
|
)
|
|
|
|
// Principal is the authenticated panel user attached to a request.
|
|
type Principal struct {
|
|
ID int64
|
|
Username string
|
|
Role Role
|
|
Domains []int64 // assigned domain IDs; empty for global (all domains)
|
|
}
|
|
|
|
// IsGlobal reports whether the principal has full panel access.
|
|
func (p Principal) IsGlobal() bool {
|
|
return p.Role == RoleGlobal
|
|
}
|
|
|
|
// CanAccessDomain reports whether the principal may access a domain id.
|
|
func (p Principal) CanAccessDomain(domainID int64) bool {
|
|
if p.IsGlobal() {
|
|
return true
|
|
}
|
|
for _, id := range p.Domains {
|
|
if id == domainID {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|
|
|
|
// CanAccessApp reports whether the principal may access an application.
|
|
func (p Principal) CanAccessApp(app store.Application) bool {
|
|
return p.CanAccessDomain(app.DomainID)
|
|
}
|
|
|
|
func principalFromUser(u store.User) Principal {
|
|
return Principal{
|
|
ID: u.ID,
|
|
Username: u.Username,
|
|
Role: u.Role,
|
|
Domains: u.DomainIDs,
|
|
}
|
|
}
|
|
|
|
func withPrincipal(ctx context.Context, p Principal) context.Context {
|
|
ctx = context.WithValue(ctx, usernameKey, p.Username)
|
|
return context.WithValue(ctx, principalKey, p)
|
|
}
|
|
|
|
// CurrentPrincipal returns the authenticated principal from the request context.
|
|
func CurrentPrincipal(ctx context.Context) (Principal, bool) {
|
|
if v, ok := ctx.Value(principalKey).(Principal); ok {
|
|
return v, true
|
|
}
|
|
return Principal{}, false
|
|
}
|
|
|
|
// PrincipalFromRequest returns the authenticated principal from an HTTP request.
|
|
func PrincipalFromRequest(r *http.Request) (Principal, bool) {
|
|
return CurrentPrincipal(r.Context())
|
|
}
|
|
|
|
// RequestWithPrincipal attaches a principal for middleware-equivalent tests.
|
|
func RequestWithPrincipal(r *http.Request, p Principal) *http.Request {
|
|
return r.WithContext(withPrincipal(r.Context(), p))
|
|
}
|