add config options to disable a domain and to disable logins for an account

to facilitate migrations from/to other mail setups.

a domain can be added in "disabled" mode (or can be disabled/enabled later on).
you can configure a disabled domain, but incoming/outgoing messages involving
the domain are rejected with temporary error codes (as this may occur during a
migration, remote servers will try again, hopefully to the correct machine or
after this machine has been configured correctly). also, no acme tls certs will
be requested for disabled domains (the autoconfig/mta-sts dns records may still
point to the current/previous machine). accounts with addresses at disabled
domains can still login, unless logins are disabled for their accounts.

an account now has an option to disable logins. you can specify an error
message to show. this will be shown in smtp, imap and the web interfaces. it
could contain a message about migrations, and possibly a URL to a page with
information about how to migrate. incoming/outgoing email involving accounts
with login disabled are still accepted/delivered as normal (unless the domain
involved in the messages is disabled too). account operations by the admin,
such as importing/exporting messages still works.

in the admin web interface, listings of domains/accounts show if they are disabled.
domains & accounts can be enabled/disabled through the config file, cli
commands and admin web interface.

for issue #175 by RobSlgm

webadmin/admin.go

@@ -1532,14 +1532,9 @@ When enabling MTA-STS, or updating a policy, always update the policy first (thr
 	return
 }
 
-// Domains returns all configured domain names, in UTF-8 for IDNA domains.
-func (Admin) Domains(ctx context.Context) []dns.Domain {
-	l := []dns.Domain{}
-	for _, s := range mox.Conf.Domains() {
-		d, _ := dns.ParseDomain(s)
-		l = append(l, d)
-	}
-	return l
+// Domains returns all configured domain names.
+func (Admin) Domains(ctx context.Context) []config.Domain {
+	return mox.Conf.DomainConfigs()
 }
 
 // Domain returns the dns domain for a (potentially unicode as IDNA) domain name.
@@ -1582,20 +1577,20 @@ func (Admin) DomainLocalparts(ctx context.Context, domain string) (localpartAcco
 	return mox.Conf.DomainLocalparts(d)
 }
 
-// Accounts returns the names of all configured accounts.
-func (Admin) Accounts(ctx context.Context) []string {
-	l := mox.Conf.Accounts()
-	sort.Slice(l, func(i, j int) bool {
-		return l[i] < l[j]
+// Accounts returns the names of all configured and all disabled accounts.
+func (Admin) Accounts(ctx context.Context) (all, disabled []string) {
+	all, disabled = mox.Conf.AccountsDisabled()
+	sort.Slice(all, func(i, j int) bool {
+		return all[i] < all[j]
 	})
-	return l
+	return
 }
 
 // Account returns the parsed configuration of an account.
 func (Admin) Account(ctx context.Context, account string) (accountConfig config.Account, diskUsage int64) {
 	log := pkglog.WithContext(ctx)
 
-	acc, err := store.OpenAccount(log, account)
+	acc, err := store.OpenAccount(log, account, false)
 	if err != nil && errors.Is(err, store.ErrAccountUnknown) {
 		xcheckuserf(ctx, err, "looking up account")
 	}
@@ -1951,11 +1946,11 @@ func DomainRecords(ctx context.Context, log mlog.Log, domain string) []string {
 }
 
 // DomainAdd adds a new domain and reloads the configuration.
-func (Admin) DomainAdd(ctx context.Context, domain, accountName, localpart string) {
+func (Admin) DomainAdd(ctx context.Context, disabled bool, domain, accountName, localpart string) {
 	d, err := dns.ParseDomain(domain)
 	xcheckuserf(ctx, err, "parsing domain")
 
-	err = admin.DomainAdd(ctx, d, accountName, smtp.Localpart(norm.NFC.String(localpart)))
+	err = admin.DomainAdd(ctx, disabled, d, accountName, smtp.Localpart(norm.NFC.String(localpart)))
 	xcheckf(ctx, err, "adding domain")
 }
 
@@ -2001,7 +1996,7 @@ func (Admin) SetPassword(ctx context.Context, accountName, password string) {
 	if len(password) < 8 {
 		xusererrorf(ctx, "message must be at least 8 characters")
 	}
-	acc, err := store.OpenAccount(log, accountName)
+	acc, err := store.OpenAccount(log, accountName, false)
 	xcheckf(ctx, err, "open account")
 	defer func() {
 		err := acc.Close()
@@ -2022,6 +2017,26 @@ func (Admin) AccountSettingsSave(ctx context.Context, accountName string, maxOut
 	xcheckf(ctx, err, "saving account settings")
 }
 
+// AccountLoginDisabledSave saves the LoginDisabled field of an account.
+func (Admin) AccountLoginDisabledSave(ctx context.Context, accountName string, loginDisabled string) {
+	log := pkglog.WithContext(ctx)
+
+	acc, err := store.OpenAccount(log, accountName, false)
+	xcheckf(ctx, err, "open account")
+	defer func() {
+		err := acc.Close()
+		log.Check(err, "closing account")
+	}()
+
+	err = admin.AccountSave(ctx, accountName, func(acc *config.Account) {
+		acc.LoginDisabled = loginDisabled
+	})
+	xcheckf(ctx, err, "saving login disabled account")
+
+	err = acc.SessionsClear(ctx, log)
+	xcheckf(ctx, err, "removing current sessions")
+}
+
 // ClientConfigsDomain returns configurations for email clients, IMAP and
 // Submission (SMTP) for the domain.
 func (Admin) ClientConfigsDomain(ctx context.Context, domain string) admin.ClientConfigs {
@@ -2640,6 +2655,17 @@ func (Admin) DomainDKIMSave(ctx context.Context, domainName string, selectors ma
 	xcheckf(ctx, err, "saving dkim selector for domain")
 }
 
+// DomainDisabledSave saves the Disabled field of a domain. A disabled domain
+// rejects incoming/outgoing messages involving the domain and does not request new
+// TLS certificats with ACME.
+func (Admin) DomainDisabledSave(ctx context.Context, domainName string, disabled bool) {
+	err := admin.DomainSave(ctx, domainName, func(d *config.Domain) error {
+		d.Disabled = disabled
+		return nil
+	})
+	xcheckf(ctx, err, "saving disabled setting for domain")
+}
+
 func xparseAddress(ctx context.Context, lp, domain string) smtp.Address {
 	xlp, err := smtp.ParseLocalpart(lp)
 	xcheckuserf(ctx, err, "parsing localpart")