A second role-scoped audit, reviewing the whole Mail Only satellite role on its own terms: role gating, the mail-dispatch channel, every Mail Only action in the privileged install script, cross-account authorization across mail-touching controllers, and cross-server admin sign-in plus webmail session isolation.
The real finding
Main talks to a linked Mail Only satellite through one internal endpoint. Its authentication was sound, but the actions it would accept were validated only loosely, so the authentication secret granted broader reach than the feature needed. No real caller ever sent anything unexpected. This is the kind of over-broad trust this audit series exists to catch. The endpoint now accepts only an explicit list of the actions real callers send, cross-checked by hand against every call site.
What else turned up
- A licence guard covered only one satellite role. Both satellite roles are exempt from licence enforcement; one shared exemption now covers both.
- Webmail’s login form was not feeding the intrusion-prevention logging that every other login in the app uses. It now logs to the same channel in the same format.
- Two provisioning-script input checks were looser than they should have been. Not reachable in practice, but both were tightened to the stricter shape used elsewhere in the file and verified against legitimate and hostile values.
Carried forward
One recurring hardening pattern was noted across several actions and scheduled as a deliberate, consistent pass rather than a rushed change.
Clean
Cross-account authorization, the most thorough dimension, was traced for every mailbox, filter, greylist, challenge-response, mailing-list, catch-all and webmail path back to an explicit ownership check. Nothing found.
Verified
Full local suite (1,693 tests) and the code-style check green after every fix. Both validation fixes were hand-verified, since that script has no automated test harness of its own.