3.8.0

This release is mostly about checks that had stopped checking. Six of the items below were invisible from the outside: the panel looked right, the installer said it had finished, and the thing that was meant to notice had quietly stopped noticing.

What this release is for

The panel's engine could not start at all. hitechcloudpanel-engine serve panicked before serving a single request - sixteen duplicate patterns in its route table, seven of them active on every stack, and four more faults in the native half (a table line with no verb, five paths matchit refuses beside a sibling catch-all, three registered twice, nine wired under the wrong verb). The hand-over is a fast path and never a dependency, so a dying sidecar left every route with the Go handler and the panel looked exactly as it always had: no error, no alert, nothing missing. Around 450 converted routes had never served a request. It now starts and serves 559 with no 405 in a full sweep. The update script asks it to start, because nothing else did.
A reseller reached four routes the panel answers 403 for. scope.User and scope.Domain were registered inside auth.RequireLogin, which is also where the hand-over happens - and it happens before calling what it wraps, so the boundary was skipped the moment a scope-wrapped route was converted. One of the four saves another account's web-server configuration. The wrapper now goes outside, which fixes those four and every route converted after them.
The mail area acted on any mailbox on the machine. Eleven /emails/* routes were RequireLogin; six API verbs and the webmail link took an address from the request and acted on it, and on the container stack that link minted a Dovecot master-user token for whatever address was named. Those are scoped to their owner now; twelve routes that are the whole machine - the Postfix queue, where scope=all reaches postsuper -d ALL, the summary reports, the postfwd policy, the mail-storage setting - are administrator-only.
Routes the engine swallowed from Go's own mux. Handles matches against a mux holding only the engine's patterns, so a claimed {rest...} took every Go-only path underneath it: seven routes answered 404 or 405 instead of what Go answers. They are declined now, and a derived test keeps the class closed.
Fifty of sixty-one CLI commands answer without the native- prefix. The old names still work. Eleven cannot follow yet and the code now says which and why, rather than leaving the reader to guess.
DANE had been silently dead since the DNS port. native-dns tlsa handed the work to dns.sh, deleted when its commands were ported; native-dnssec's fallback for the same records called native-dns tlsa publish, which handed back to the same missing file - both paths broken at once, so no TLSA record had been published and nothing said so. Fixed along with every other call site that still named a deleted helper script, and a test now reads the whole tree for them. Ported with it: the remaining ~1,100 lines of dns.sh (tlsa, bimi, spf-senders, spf-budget, consolidate, backfill), the interface language (locale.sh), the FTP login an account is given on creation (ftp/add.sh), and ssl renew-all, which had never been a verb on the compiled side.
A fresh install could end up with no compiled CLI and only a warning. INSTALL.sh's third fallback - build from the submodule with cargo - tested for hitechcloudcli/rustcli/Cargo.toml, and the crate directory had been renamed to cli/. The test was false on every machine, so a server with cargo but no prebuilt binary and no reachable release fell through to the bash dispatcher, which is a release behind and, on 3.7.4, meant no scheduled jobs at all. A check now asserts that every manifest the installer names is a file the checkout has.
Thirty places where PATH decided whether the CLI could find itself. A bare hitechcloudcli is resolved through PATH, which has no /usr/local/bin under a systemd unit with no Environment= - so a command could write a certificate and then not find the program that publishes it, or reach the bash dispatcher instead of the compiled binary with nothing to say so. All thirty now name the running program by its own path, keeping the history line and hooks they had.
The installer wrote its own log-rotation rules, and they were the older ones. native-install and server-logrotate both write /etc/logrotate.d/hitechcloud-native; the command's version was fixed and the installer's copy was not. Its postrotate ran native-service reload web, which does not include the front end - whose own log is one of the files being rotated - so the front end kept writing to the rotated file and its log appeared to stop the night the rule first ran. It also put both globs in one block, giving a per-domain access log the system retention instead of the longer one those records are held to. Normally the scheduled job would overwrite the file within a day; on a server whose scheduled jobs never installed it never runs, so the installer's version was the only one there would ever be. Both now come from one function.
A reseller could read every customer's support conversation on the machine, and write into any of them. Live Chat's four routes asked nobody who owned what they named: the list read /home directly, POST /livechat/send wrote into any account's file signed "admin" with the account taken from the form, and the engine twin of the JSON route was unchecked too - which is the copy the request actually reaches, since the hand-over happens before the Go handler runs. Also fixed in the same pass: POST /server/ip-addresses trusted the form, so a reseller could assign or release an address belonging to another reseller's customer; /plan/apply/{filename} served any file in /tmp to any session; and /backups/user/action-status answered every caller from one package variable whose message names the account a run was working on. Three sidebar links pointed at administrator-only pages and could only ever answer 403, and /server/ip-addresses - written for a reseller throughout - was hidden from them entirely.

Added

Let a browser walk the mirror.
The domain pages answered by the engine (#615).
The monitoring, firewall and quarantine JSON API (and the sidecar could not start) (#617).
The home page says what the illustration says (#629).

Fixed

The feed was dropping most of what it saw, in silence.
The management host has no python3 (#610).
Browse alone would not have worked (#611).
The check failed a change that had worked (#612).
Stop a stopped database server costing a page two socket waits (#606).
Notification emails read <b> instead of showing bold (#607).
The sidecar could not start at all (#621).
Routes the twin swallowed, and the twin that could not start (#624).
The hitechcloudcli pointer named a commit that does not exist.
The native stack suite was testing scripts that no longer exist.
A fresh install brings neither ClamAV nor ImunifyAV.
The eight TLS failures were the harness, not native-ssl (#630).
The registry now says which modules a fresh install brings.
The source-build fallback tested a path that no longer exists.
A 3.8.0 check that could never pass, and a diagnostic that ignored its own limit.
A missing binary skipped the file and published the release anyway.