selfpost/internal/store/migrations/0001_init.sql

-- SelfPost 2.0 baseline schema. One SQLite file under /data holds the whole
-- panel state, so a single directory backup/restore is sufficient.
--
-- This file IS the 2.0 schema: the 1.x chain (0001..0010, with its admin table
-- created and dropped again) was deleted, not squashed with an upgrade path —
-- 2.0 starts from an empty data directory (docs/schema-migrations.md). Later
-- changes ship as 0002_*.sql and onwards; this file is never edited again once
-- 2.0.0 is released.

-- Marks the file as a 2.x SelfPost database ("SP20"). store.Open refuses a
-- database that has a schema version but not this mark, which is what a 1.x
-- file looks like: its user_version would otherwise read as "already migrated".
PRAGMA application_id = 1397764656;

-- Free-form key/value settings of the instance: what is true whoever is signed
-- in (send-log retention). Nothing that belongs to a user lives here.
CREATE TABLE settings (
    key   TEXT PRIMARY KEY,
    value TEXT NOT NULL
);

-- Panel logins (not application SASL accounts). The presence of a row is what
-- marks primary setup as complete, which is why /setup disappears once one
-- exists. role is a reach, not a rank: 'global' sees the whole instance,
-- 'domain' only what is assigned below.
--
-- email is the user's own address — what the panel writes to. The DMARC
-- default is a separate choice that may use it: dmarc_default_mode says where
-- aggregate reports go for a domain that follows this user
-- (domains.dmarc_rua_user_id): 'hosted' (SelfPost's own mailbox for that
-- domain), 'account' (email above), 'custom' (dmarc_default_address) or 'none'.
--
-- all_domains / all_inbound_domains widen a 'domain' user's list to every
-- domain of that direction, including the ones added later; with a flag set
-- the rows of the matching assignment table are ignored.
CREATE TABLE users (
    id                    INTEGER PRIMARY KEY AUTOINCREMENT,
    username              TEXT NOT NULL UNIQUE,
    password_hash         TEXT NOT NULL,
    role                  TEXT NOT NULL CHECK (role IN ('global', 'domain')),
    email                 TEXT NOT NULL DEFAULT '',
    dmarc_default_mode    TEXT NOT NULL DEFAULT 'none'
                          CHECK (dmarc_default_mode IN ('hosted', 'account', 'custom', 'none')),
    dmarc_default_address TEXT NOT NULL DEFAULT '',
    all_domains           INTEGER NOT NULL DEFAULT 0 CHECK (all_domains IN (0, 1)),
    all_inbound_domains   INTEGER NOT NULL DEFAULT 0 CHECK (all_inbound_domains IN (0, 1)),
    created_at            TEXT NOT NULL
);

-- Panel login sessions. Persisted so a login survives a container restart or
-- redeploy; only the SHA-256 of the session token is stored, never the token
-- itself, so a stolen database file cannot be used to sign in. expires_at
-- implements the sliding idle timeout: it is pushed forward on activity rather
-- than being fixed at creation time. A session belongs to a user by id, not by
-- name: deleting the user ends their sessions, and renaming them leaves the
-- sessions where they are.
CREATE TABLE sessions (
    token_hash TEXT PRIMARY KEY,
    user_id    INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
    created_at TEXT NOT NULL,
    expires_at TEXT NOT NULL
);
CREATE INDEX idx_sessions_expires_at ON sessions (expires_at);

-- Sending (outbound) domains. DKIM keys themselves live on disk under /data;
-- this row records the selector and metadata.
--
-- Where the domain's DMARC aggregate reports go (rua=): with dmarc_rua_user_id
-- set, the domain follows that user's default and dmarc_rua is ignored;
-- otherwise dmarc_rua is the address itself, '' meaning no reports. Deleting
-- the user leaves the domain at "none" rather than silently handing its
-- reports to someone else.
CREATE TABLE domains (
    id                INTEGER PRIMARY KEY AUTOINCREMENT,
    name              TEXT NOT NULL UNIQUE,
    dkim_selector     TEXT NOT NULL,
    dmarc_rua         TEXT NOT NULL DEFAULT '',
    dmarc_rua_user_id INTEGER REFERENCES users(id) ON DELETE SET NULL,
    created_at        TEXT NOT NULL
);

-- Outbound domains assigned to a 'domain' user.
CREATE TABLE user_domains (
    user_id   INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
    domain_id INTEGER NOT NULL REFERENCES domains(id) ON DELETE CASCADE,
    PRIMARY KEY (user_id, domain_id)
);

-- Applications bound to a domain. address_mode is either the domain wildcard or
-- an explicit address list; the SASL login is globally unique.
--
-- auth_ip_restrict / auth_allowed_ips restrict which client IPs may submit as
-- the application at all (refused otherwise). That is independent of the
-- level-2 rate limits below.
CREATE TABLE applications (
    id               INTEGER PRIMARY KEY AUTOINCREMENT,
    domain_id        INTEGER NOT NULL REFERENCES domains(id) ON DELETE CASCADE,
    login            TEXT NOT NULL UNIQUE,
    address_mode     TEXT NOT NULL CHECK (address_mode IN ('wildcard', 'list')),
    auth_ip_restrict INTEGER NOT NULL DEFAULT 0,
    auth_allowed_ips TEXT,
    created_at       TEXT NOT NULL
);

-- Explicit sender addresses for applications in 'list' mode. Each address must
-- belong to the application's domain (validated in the panel).
CREATE TABLE application_addresses (
    id             INTEGER PRIMARY KEY AUTOINCREMENT,
    application_id INTEGER NOT NULL REFERENCES applications(id) ON DELETE CASCADE,
    address        TEXT NOT NULL,
    UNIQUE (application_id, address)
);

-- Level-2 rate limits per domain or application. In 'auto' mode max_messages
-- is derived from 30-day send statistics times auto_multiplier.
CREATE TABLE rate_limits (
    id              INTEGER PRIMARY KEY AUTOINCREMENT,
    scope           TEXT NOT NULL CHECK (scope IN ('domain', 'application')),
    ref_id          INTEGER NOT NULL,
    max_messages    INTEGER,
    window_seconds  INTEGER,
    mode            TEXT NOT NULL DEFAULT 'manual' CHECK (mode IN ('manual', 'auto')),
    auto_multiplier REAL,
    auto_updated_at TEXT,
    UNIQUE (scope, ref_id)
);

-- Structured send log. One row per (queue-id, recipient); the log-tailer
-- advances status from queued to a final state.
CREATE TABLE send_log (
    id         INTEGER PRIMARY KEY AUTOINCREMENT,
    queue_id   TEXT,
    domain     TEXT,
    app_login  TEXT,
    from_addr  TEXT,
    to_addr    TEXT,
    subject    TEXT,
    status     TEXT NOT NULL,
    created_at TEXT NOT NULL,
    updated_at TEXT NOT NULL
);
CREATE INDEX idx_send_log_queue_id ON send_log (queue_id);
CREATE INDEX idx_send_log_domain ON send_log (domain);
CREATE INDEX idx_send_log_created_at ON send_log (created_at);
-- The journal milter counts messages for a level-2 limit on every MAIL FROM,
-- and the domain page computes 30-day statistics per application on every
-- render: equality on app_login, range on created_at.
CREATE INDEX idx_send_log_app_login_created_at ON send_log (app_login, created_at);

-- Log-tailer read position. Without it the tailer starts at end-of-file on
-- every start, so delivery lines written while the panel was down are never
-- parsed and their send-log rows stay "queued" forever. One row per followed
-- path; fingerprint identifies the file the offset belongs to (the head bytes
-- of the log), so a rotated or recreated mail.log is detected across a restart,
-- where os.SameFile cannot help.
CREATE TABLE logtail_state (
    path        TEXT PRIMARY KEY,
    fingerprint TEXT NOT NULL,
    read_offset INTEGER NOT NULL,
    updated_at  TEXT NOT NULL
);

-- Optional inbound relay (backup-MX / forwarder). A separate entity from the
-- sending domains, even under the same name: these rows exist while
-- INBOUND_RELAY_ENABLE is false, but the listener, the Postfix maps and the
-- panel pages are generated only when that flag is on.
CREATE TABLE inbound_domains (
    id             INTEGER PRIMARY KEY AUTOINCREMENT,
    name           TEXT NOT NULL UNIQUE,
    recipient_mode TEXT NOT NULL CHECK (recipient_mode IN ('list', 'any')),
    created_at     TEXT NOT NULL
);

-- One upstream per inbound domain (host:port + TLS policy for the hand-off).
CREATE TABLE inbound_transports (
    inbound_domain_id INTEGER PRIMARY KEY REFERENCES inbound_domains(id) ON DELETE CASCADE,
    host              TEXT NOT NULL,
    port              INTEGER NOT NULL CHECK (port >= 1 AND port <= 65535),
    tls_mode          TEXT NOT NULL CHECK (tls_mode IN ('may', 'encrypt', 'none'))
);

-- Explicit recipients for recipient_mode = 'list'. Ignored when mode is 'any'.
CREATE TABLE inbound_recipients (
    id                INTEGER PRIMARY KEY AUTOINCREMENT,
    inbound_domain_id INTEGER NOT NULL REFERENCES inbound_domains(id) ON DELETE CASCADE,
    address           TEXT NOT NULL,
    UNIQUE (inbound_domain_id, address)
);

-- Inbound domains assigned to a 'domain' user — granted separately from the
-- outbound ones above; the same name on both lists is two assignments.
CREATE TABLE user_inbound_domains (
    user_id           INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
    inbound_domain_id INTEGER NOT NULL REFERENCES inbound_domains(id) ON DELETE CASCADE,
    PRIMARY KEY (user_id, inbound_domain_id)
);

-- DMARC aggregate report summaries. One row per parsed report; per-source rows
-- hang off it. Forensic (ruf=) payloads are not stored.
CREATE TABLE dmarc_reports (
    id            INTEGER PRIMARY KEY AUTOINCREMENT,
    domain        TEXT NOT NULL,
    reporter      TEXT NOT NULL,
    report_id     TEXT NOT NULL,
    period_begin  TEXT NOT NULL,
    period_end    TEXT NOT NULL,
    received_at   TEXT NOT NULL,
    contact_email TEXT NOT NULL DEFAULT '',
    policy_p      TEXT NOT NULL DEFAULT '',
    policy_sp     TEXT NOT NULL DEFAULT '',
    policy_pct    INTEGER NOT NULL DEFAULT 100,
    policy_adkim  TEXT NOT NULL DEFAULT '',
    policy_aspf   TEXT NOT NULL DEFAULT '',
    pass_count    INTEGER NOT NULL DEFAULT 0,
    fail_count    INTEGER NOT NULL DEFAULT 0,
    recipient     TEXT NOT NULL DEFAULT '',
    UNIQUE (reporter, report_id, domain)
);
CREATE INDEX idx_dmarc_reports_domain ON dmarc_reports (domain);
CREATE INDEX idx_dmarc_reports_received ON dmarc_reports (received_at);

CREATE TABLE dmarc_report_records (
    id            INTEGER PRIMARY KEY AUTOINCREMENT,
    report_row_id INTEGER NOT NULL REFERENCES dmarc_reports(id) ON DELETE CASCADE,
    source_ip     TEXT NOT NULL DEFAULT '',
    count         INTEGER NOT NULL,
    disposition   TEXT NOT NULL DEFAULT '',
    spf_result    TEXT NOT NULL DEFAULT '',
    dkim_result   TEXT NOT NULL DEFAULT '',
    header_from   TEXT NOT NULL DEFAULT ''
);
CREATE INDEX idx_dmarc_report_records_report ON dmarc_report_records (report_row_id);