mixandClaude Opus 5.5
3b86f6c3b6
Stage 1, step 2 (plan § Who sees what).
Store
- Reach{AllDomains, DomainIDs, AllInbound, InboundDomainIDs} is what a
domain user is assigned. CreateUser takes it; SetUserReach / ClearUserReach
replace SetUserDomains / ClearUserDomains and write both directions in one
transaction. A domain user with nothing on either list is refused
(ErrEmptyReach). With All set the rows of that direction are not stored,
so clearing All later brings nothing stale back.
- ListDomainsForUser honours all_domains; ListInboundDomainsForUser is its
inbound twin. Both filter in the query.
Authorization
- auth.Principal carries the whole reach: CanAccessDomain (now also true
with All), CanAccessInboundDomain, HasOutbound, HasInbound. An id or a
name on one list opens nothing on the other.
- Inbound handlers in three strengths: requireInbound (the list, filtered),
requireInboundDomain (one domain: page, DNS re-check, upstream,
recipients), requireInboundGlobal (add, delete confirm, delete). All
answer the same 404.
- domainIDSet and the DMARC report pages go through the principal instead
of looking at p.Domains themselves.
Panel (old templates, until stage 2)
- User form: two lists with All; inbound is offered only where the feature
is on, and saving the form with it off keeps the user's inbound reach.
Promotion to global drops the reach.
- Menu: a group with nothing assigned is absent; / sends an inbound-only
administrator to Inbound. The inbound pages hide add / delete from a
domain administrator.
Tests: every route of one inbound domain against five kinds of refused
request (another tenant's id, a missing id, outbound-only reach, an outbound
domain with the same id, one with the same name, no principal) with the 404
bodies compared; add/delete as every non-global user; the filtered list
including a domain added later; thirteen outbound routes against another
tenant's domain and application id; the user form; the reach in the store;
the principal matrix; the menu; the home redirect. Removing the access check
or the query filter makes the tests fail (checked by hand).
go test ./... green except the two Windows-only failures in internal/domain
and internal/logtail that predate this work.
Roadmap 12/27.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
78 lines
2.1 KiB
Go
78 lines
2.1 KiB
Go
package handlers
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"github.com/mixeme/selfpost/internal/dmarc"
|
|
"github.com/mixeme/selfpost/internal/store"
|
|
"github.com/mixeme/selfpost/internal/web/auth"
|
|
)
|
|
|
|
func (h *Handlers) principal(r *http.Request) (auth.Principal, bool) {
|
|
return auth.PrincipalFromRequest(r)
|
|
}
|
|
|
|
func (h *Handlers) requireGlobal(w http.ResponseWriter, r *http.Request) (auth.Principal, bool) {
|
|
p, ok := h.principal(r)
|
|
if !ok || !p.IsGlobal() {
|
|
http.NotFound(w, r)
|
|
return auth.Principal{}, false
|
|
}
|
|
return p, true
|
|
}
|
|
|
|
func (h *Handlers) pageBase(r *http.Request) map[string]any {
|
|
p, _ := h.principal(r)
|
|
return map[string]any{
|
|
"User": auth.CurrentUser(r),
|
|
"IsGlobal": p.IsGlobal(),
|
|
// Which groups the menu shows this user (plan § Who sees what).
|
|
"HasOutbound": p.HasOutbound(),
|
|
"HasInbound": p.HasInbound(),
|
|
}
|
|
}
|
|
|
|
func (h *Handlers) assignedDomains(p auth.Principal) ([]store.Domain, error) {
|
|
if p.IsGlobal() {
|
|
return h.store.ListDomains()
|
|
}
|
|
return h.store.ListDomainsForUser(p.ID)
|
|
}
|
|
|
|
// hostedDMARCAddress is the SelfPost-hosted report mailbox for a sending
|
|
// domain, "" when report ingest is off on this server.
|
|
func (h *Handlers) hostedDMARCAddress(domainName string) string {
|
|
if h.dmarc == nil || !h.cfg.DMARCEnabled {
|
|
return ""
|
|
}
|
|
return dmarc.HostedReportAddress(h.cfg.Hostname, domainName)
|
|
}
|
|
|
|
// domainReportAddress resolves where a domain's DMARC aggregate reports go:
|
|
// its own address, or the default of the user it follows. "" is a policy-only
|
|
// record.
|
|
func (h *Handlers) domainReportAddress(d store.Domain) (string, error) {
|
|
return h.store.DomainDMARCRua(d, h.hostedDMARCAddress(d.Name))
|
|
}
|
|
|
|
func domainNameSet(domains []store.Domain) map[string]bool {
|
|
m := make(map[string]bool, len(domains))
|
|
for _, d := range domains {
|
|
m[d.Name] = true
|
|
}
|
|
return m
|
|
}
|
|
|
|
// domainIDSet is the set of sending domains a principal is limited to; nil
|
|
// means no limit (the global role, or a domain user with All).
|
|
func domainIDSet(p auth.Principal) map[int64]bool {
|
|
if p.IsGlobal() || p.AllDomains {
|
|
return nil
|
|
}
|
|
m := make(map[int64]bool, len(p.Domains))
|
|
for _, id := range p.Domains {
|
|
m[id] = true
|
|
}
|
|
return m
|
|
}
|