mixandClaude Opus 5.5
96db0b7a86
Follows the design and guard commits before it. Written by Sonnet,
reviewed by Opus.
The report address
- Baseline: users.dmarc_default_mode, users.dmarc_default_address and
domains.dmarc_rua_user_id are gone. domains.dmarc_rua alone says
where reports go: '' is no reports (a new domain), the address
SelfPost derives for the domain is the hosted choice (while hosted
reports are on), anything else is a typed address.
- Removed: the user default and its store functions, a domain
following a user, keep / inherit, followCreator, POST /account/dmarc
with its handler, the DMARC box of Account, the user-delete item
about domains losing their address.
- Domain settings offers the three choices; beside the typed address a
"Use my e-mail" button fills in the profile e-mail (panel.js: one
generic data-fill hook; absent without a profile e-mail; it fills,
it does not save).
- The DMARC record's note names the address and no user. This closes
L4 of the security review.
- Domain export / import carries the address as a plain string.
- The ingest allow-list is the generic mailbox plus each domain's
address on this host; the generic mailbox is always open now.
- dev/migrate1x (not in the tree): a 1.x domain that inherited the
instance default gets that address as its own, so no published rua=
changes.
Row actions
- row_action partial (RowAction: Label, Post, Confirm, Danger);
panel.css has the mockup's three rules. A row of the Applications
table is Edit, New password, Delete; the confirmation texts are the
ones the application page's head uses. Both roles, with the checks
of the application page.
Tests cover: a new domain has no reports; each choice saved and shown
selected; hosted refused when hosted reports are off; a bad address
refused with what was typed kept; an untouched save changes nothing in
each state; the fill button with and without a profile e-mail; deleting
a user leaves every domain's address; the row's forms, targets and
confirmations for both roles and a 404 for a stranger.
Known: if hosted reports are switched off later, a stored hosted address
reads as a typed one. docs/guide.md still describes the old choices -
the documentation step.
Evidence
- docs/assets/panel-redesign/evidence/account.png,
out-domain-settings.png, out-domain.png, user-delete.png, help.png:
1440 px wide, headless Edge, real templates served locally with
their fixtures - NOT from the container.
- panel/audit.js on out-domain, out-domain-settings, account, help,
components and user-delete at 1440 and 1280: 1420 texts checked,
problems: [].
- In a browser: the fill button sets the field and does not submit;
the row buttons have the font, size and colour of the Edit link,
Delete the red of the other delete links; data-confirm fires on
both. Hover and focus states were not observed.
- go test -count=1 ./internal/web/... ./internal/store/...
./internal/dmarc/... ./internal/app/... ./internal/inbound/...
./cmd/panel: ok (ten packages; dev/migrate1x also ok).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
56 lines
3.8 KiB
HTML
56 lines
3.8 KiB
HTML
{{/* The user form (mockup user.html): one form that creates a panel user and
|
|
edits one. The account is the left column; on the right the domains the user
|
|
reaches, outbound and inbound as two lists, each with its All. panel.js hides
|
|
the lists while the role is Global (data-global-role on the select,
|
|
data-domain-pick on the boxes); without scripts they stay in view and the
|
|
server ignores them for the global role. A blank password keeps the current
|
|
one. */}}
|
|
{{define "content"}}
|
|
{{template "page_head" .Head}}
|
|
{{if .Flash}}{{template "flash" .Flash}}{{end}}
|
|
|
|
<form class="sp-form" method="post" action="{{.Action}}">
|
|
<div class="columns">
|
|
<div class="column is-6">
|
|
{{template "box_open" .Account}}
|
|
{{template "body_open"}}
|
|
<div class="field"><label class="label" for="username">Username</label><div class="control"><input class="input" id="username" name="username" value="{{.Username}}" autocomplete="username" autocapitalize="none" spellcheck="false" required></div></div>
|
|
<div class="field"><label class="label" for="email">E-mail</label><div class="control"><input class="input" id="email" name="email" type="email" value="{{.Email}}" autocomplete="off"></div>
|
|
<p class="help">The user's own address. They can change it under Account.</p></div>
|
|
<div class="field"><label class="label" for="password">Password</label><div class="control"><input class="input" id="password" name="password" type="password" autocomplete="new-password"{{if .NewUser}} required{{end}}></div>
|
|
<p class="help">{{if .NewUser}}At least {{.PasswordMin}} characters.{{else}}Leave empty to keep the current one.{{end}}</p></div>
|
|
<div class="field"><label class="label" for="role">Role</label>
|
|
{{if .RoleLocked}}<input type="hidden" name="role" value="{{.Role}}">{{end}}
|
|
<div class="control"><div class="select is-fullwidth"><select id="role" name="role" data-global-role="global"{{if .RoleLocked}} disabled{{end}}>{{$sel := .Role}}{{range .Roles}}
|
|
<option value="{{.Value}}"{{if eq .Value $sel}} selected{{end}}>{{.Label}}</option>{{end}}
|
|
</select></div></div>
|
|
<p class="help">Everyone here is an administrator; the role is the reach. <em>Global</em> also sees Server and is the only one who adds or deletes domains. The only global user cannot be changed to <em>domain</em> or deleted.</p></div>
|
|
{{template "body_close"}}
|
|
{{template "box_close"}}
|
|
</div>
|
|
<div class="column is-6">
|
|
{{template "box_open" .Outbound}}
|
|
{{template "body_open"}}
|
|
<div class="field"><label class="checkbox"><input type="checkbox" name="all_domains" value="1"{{if .AllOut}} checked{{end}}> <strong>All outbound domains</strong>, including ones added later</label></div>{{range .OutDomains}}
|
|
<div class="field"><label class="checkbox"><input type="checkbox" name="domain_ids" value="{{.ID}}"{{if .Checked}} checked{{end}}> {{.Name}}</label></div>{{end}}
|
|
<p class="help">With <em>All</em> ticked the single domains are ignored.</p>
|
|
{{template "body_close"}}
|
|
{{template "box_close"}}
|
|
{{if .ShowInbound}}
|
|
{{template "box_open" .Inbound}}
|
|
{{template "body_open"}}
|
|
<div class="field"><label class="checkbox"><input type="checkbox" name="all_inbound_domains" value="1"{{if .AllIn}} checked{{end}}> <strong>All inbound domains</strong>, including ones added later</label></div>{{range .InDomains}}
|
|
<div class="field"><label class="checkbox"><input type="checkbox" name="inbound_domain_ids" value="{{.ID}}"{{if .Checked}} checked{{end}}> {{.Name}}</label></div>{{end}}
|
|
<p class="help">Granted separately from outbound: the same name on both lists is two assignments. The <em>domain</em> role needs at least one domain, or <em>All</em>, on either list.</p>
|
|
{{template "body_close"}}
|
|
{{template "box_close"}}
|
|
{{end}}
|
|
</div>
|
|
</div>
|
|
<div class="buttons">
|
|
<button type="submit" class="button is-primary">{{.Submit}}</button>
|
|
<a class="button is-text" href="{{.CancelHref}}">Cancel</a>
|
|
</div>
|
|
</form>
|
|
{{end}}
|