Fix three defects a full VM migration exposed

Ran a complete 0.15.5 -> 0.16.14 migration of the smoke VM, driving the
phases in the order the real pipeline will. It worked - all mail intact and
readable afterwards, all ten listeners up, cutover executed for the first
time ever and checkpoint resume exercised - and it exposed three defects.

1. The converted config was installed root-owned while the service runs as
   its own user. Stalwart crash-looped 28 times on "Failed to read data
   store settings: Permission denied", minutes after the mistake and
   nowhere near it. This is the same ownership trap that retired the
   rollback implementation, in a new place: writing files as root is the
   natural thing for a tool running as root to do, and it is wrong every
   time the service is not root.

   Cutover now installs the config itself, copying ownership and mode from
   the config being replaced.

2. v0.16.14 does not serve /api - the endpoint stalwartapi assumed.
   Confirmed against a fully migrated, fully configured, serving instance
   rather than a sandbox: /api, /api/principal and /jmap/ all 404. The JMAP
   endpoint is the one the session document advertises, which is what RFC
   8620 discovery is for.

   The client now discovers it, re-basing the advertised path onto the
   operator's host: a real instance advertises its canonical public URL
   ("https://mail.smoke.test/jmap/") which frequently isn't reachable from
   where this tool runs. The session is authoritative about the path; the
   operator is authoritative about the host.

3. Dispatching on the urn:stalwart:jmap capability was wrong, because
   NEITHER version advertises it - not 0.15.5, and not a fully migrated
   0.16.14. That sent 0.16 instances down the 0.15 REST path where every
   call 404s. The client probes what the instance actually serves instead.
   Less elegant than a declared capability, with the advantage of being
   true.

Also: a JMAP "forbidden" now explains itself. An account holding the admin
role before the migration was refused x:Account/query afterwards, and a
bare "forbidden" gives an operator nowhere to start. Whether the role
failed to carry or v0.16 wants different permissions was not isolated, and
that question is recorded as open - it gates quota recalculation and any
post-migration validation.

Verified against both live instances: the 0.15.5 reports 3 accounts and its
domain over REST, and the migrated 0.16.14 routes to JMAP, finds the right
endpoint, and returns the explained refusal.

internal/cutover/cutover.go

@@ -13,6 +13,7 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+	"syscall"
 	"time"
 
 	"github.com/LINUXexpert-org/stalwart-migrator/internal/checkpoint"
@@ -46,6 +47,16 @@ type Options struct {
 	// becomes the unit's --config argument.
 	ServiceUnitPath string
 	ConfigPath      string
+	// ConfigSource, if set, is installed to ConfigPath before the unit is
+	// repointed at it - the converted v0.16 config the migration produced.
+	// Its ownership and mode are copied from ConfigOwnerReference (the old
+	// config, normally), because the service does not run as root and a
+	// root-owned config it cannot read fails the service at startup, not at
+	// install time. That is not hypothetical: a full migration crash-looped
+	// 28 times on "Failed to read data store settings: Permission denied"
+	// for exactly this reason.
+	ConfigSource         string
+	ConfigOwnerReference string
 
 	// RecoveryPointConfirmed is the operator asserting that a recovery
 	// point exists for this machine. This tool does not take one, verify
@@ -88,6 +99,7 @@ type Plan struct {
 	BinaryPath        string
 	ServiceUnitPath   string
 	ConfigPath        string
+	ConfigSource      string
 	RecalculateQuotas bool
 }
 
@@ -95,7 +107,10 @@ func (p Plan) String() string {
 	var b strings.Builder
 	fmt.Fprintf(&b, "cutover plan for run %s:\n", p.RunID)
 	fmt.Fprintf(&b, "  1. confirm %s really is %s, then install it as %s\n", p.StagedBinaryPath, p.TargetVersion, p.BinaryPath)
-	fmt.Fprintf(&b, "  2. preserve %s, then point its ExecStart at the new binary and strip any recovery-mode env vars\n", p.ServiceUnitPath)
+	if p.ConfigSource != "" {
+		fmt.Fprintf(&b, "  2. install %s as %s, owned so the service user can read it\n", p.ConfigSource, p.ConfigPath)
+	}
+	fmt.Fprintf(&b, "  3. preserve %s, then point its ExecStart at the new binary and strip any recovery-mode env vars\n", p.ServiceUnitPath)
 	fmt.Fprintf(&b, "  3. reload the service definition and start %s\n", p.Target)
 	fmt.Fprint(&b, "  4. wait for it to answer an authenticated JMAP session request\n")
 	if p.RecalculateQuotas {
@@ -116,6 +131,7 @@ func BuildPlan(rs *checkpoint.RunState, opts Options) (Plan, error) {
 		RunID: rs.RunID, TargetVersion: rs.TargetVersion,
 		StagedBinaryPath: opts.StagedBinaryPath, BinaryPath: opts.BinaryPath,
 		ServiceUnitPath: opts.ServiceUnitPath, ConfigPath: opts.ConfigPath,
+		ConfigSource:      opts.ConfigSource,
 		RecalculateQuotas: opts.RecalculateQuotas,
 	}
 
@@ -239,6 +255,22 @@ func Run(ctx context.Context, store *checkpoint.Store, rs *checkpoint.RunState,
 		return report, err
 	}
 
+	if err := step("install-config", func() (checkpoint.StepOutcome, error) {
+		if plan.ConfigSource == "" {
+			return checkpoint.StepOutcome{
+				Verdict: string(StatusSkipped),
+				Detail:  "no converted config to install - the unit is repointed at whatever is already at ConfigPath",
+			}, nil
+		}
+		owner, err := installConfig(plan.ConfigSource, plan.ConfigPath, opts.ConfigOwnerReference)
+		if err != nil {
+			return checkpoint.StepOutcome{}, err
+		}
+		return checkpoint.StepOutcome{Detail: fmt.Sprintf("installed %s as %s (%s)", plan.ConfigSource, plan.ConfigPath, owner)}, nil
+	}); err != nil {
+		return report, err
+	}
+
 	if err := step("update-service-definition", func() (checkpoint.StepOutcome, error) {
 		preserved, err := preserveUnit(plan.ServiceUnitPath, rs.RunID)
 		if err != nil {
@@ -498,3 +530,44 @@ func hashFile(path string) (sha256Hex string, size int64, err error) {
 	}
 	return hex.EncodeToString(h.Sum(nil)), n, nil
 }
+
+// installConfig places the converted config at dst, copying ownership and
+// mode from reference (normally the config being replaced) so the service
+// user can still read it.
+//
+// Ownership is the whole point of this function. Writing a config as root
+// is the natural thing for a tool running as root to do, and it produces a
+// service that starts, fails to read its own config, and restarts forever -
+// a failure that shows up minutes later in the journal rather than at the
+// moment of the mistake. Where no reference is available the file is left
+// world-readable, since a config the service cannot read is worse than one
+// other local users can.
+func installConfig(src, dst, reference string) (ownership string, err error) {
+	data, err := os.ReadFile(src)
+	if err != nil {
+		return "", fmt.Errorf("cutover: read converted config %s: %w", src, err)
+	}
+
+	perm := os.FileMode(0o644)
+	uid, gid := -1, -1
+	if reference == "" {
+		reference = dst // fall back to whatever is already in place
+	}
+	if info, statErr := os.Stat(reference); statErr == nil {
+		perm = info.Mode().Perm()
+		if sys, ok := info.Sys().(*syscall.Stat_t); ok {
+			uid, gid = int(sys.Uid), int(sys.Gid)
+		}
+	}
+
+	if err := writeFileAtomic(dst, data, perm); err != nil {
+		return "", err
+	}
+	if uid >= 0 && gid >= 0 {
+		if err := os.Chown(dst, uid, gid); err != nil {
+			return "", fmt.Errorf("cutover: set ownership on %s to %d:%d - the service runs as that user and cannot read a config it does not own: %w", dst, uid, gid, err)
+		}
+		return fmt.Sprintf("uid %d, gid %d, mode %v", uid, gid, perm), nil
+	}
+	return fmt.Sprintf("mode %v, ownership unchanged (no reference file to copy it from)", perm), nil
+}

internal/cutover/cutover_test.go

@@ -388,3 +388,63 @@ func TestRunSchedulesOneQuotaTaskPerAccountAndWaits(t *testing.T) {
 		}
 	}
 }
+
+// A full migration crash-looped 28 times on "Failed to read data store
+// settings: Permission denied" because the converted config was written as
+// root while the service runs as its own user. The failure surfaced minutes
+// later in the journal, not at the moment of the mistake, which is what
+// makes it worth a test rather than care.
+func TestRunInstallsTheConfigWithOwnershipTheServiceCanRead(t *testing.T) {
+	store, rs, opts := migratedRun(t)
+	dir := t.TempDir()
+
+	// The config being replaced, standing in for the one the old version
+	// ran with - restrictive mode, so a naive copy would lock the service
+	// out of its own config.
+	oldConfig := filepath.Join(dir, "config.toml")
+	if err := os.WriteFile(oldConfig, []byte("[server]\n"), 0o640); err != nil {
+		t.Fatal(err)
+	}
+	converted := filepath.Join(dir, "converted.json")
+	if err := os.WriteFile(converted, []byte(`{"@type":"RocksDb","path":"/opt/stalwart/data"}`), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	installed := filepath.Join(dir, "config.json")
+
+	opts.ConfigSource = converted
+	opts.ConfigPath = installed
+	opts.ConfigOwnerReference = oldConfig
+
+	report, err := Run(context.Background(), store, rs, opts)
+	if err != nil {
+		t.Fatalf("Run: %v\n%s", err, report)
+	}
+	if got := readFile(t, installed); !strings.Contains(got, "RocksDb") {
+		t.Errorf("installed config = %q, want the converted one", got)
+	}
+	info, err := os.Stat(installed)
+	if err != nil {
+		t.Fatal(err)
+	}
+	// Mode comes from the file being replaced, not from the source's 0600.
+	if info.Mode().Perm() != 0o640 {
+		t.Errorf("installed config mode = %v, want 0640 copied from the old config", info.Mode().Perm())
+	}
+	// The unit must point at the installed config, not the scratch copy.
+	if unit := readFile(t, opts.ServiceUnitPath); !strings.Contains(unit, installed) {
+		t.Errorf("unit does not reference the installed config:\n%s", unit)
+	}
+}
+
+func TestRunSkipsConfigInstallWhenThereIsNothingToInstall(t *testing.T) {
+	store, rs, opts := migratedRun(t)
+	report, err := Run(context.Background(), store, rs, opts)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, res := range report.Results {
+		if res.Name == "install-config" && res.Status != StatusSkipped {
+			t.Errorf("install-config = %s, want skip when no ConfigSource is given", res.Status)
+		}
+	}
+}