15 Commits

Include renames

Author	SHA1	Message	Date
Lucas RayanandClaude Sonnet 5.5	5bbbb85128	release: 1.0.0, a changelog, one .env.example and the docs to match ... - CHANGELOG.md and CHANGELOG.pt-BR.md, from the project history. - .env.example now serves development and production; scripts/init-env.sh (make env) creates .env with random secrets. .env.production.example is gone. - docs/RELEASING.md: the pipeline, how a version is cut and deployed, the runners. - DEPLOYMENT.md and both READMEs updated for Gitea and the new env flow. - Service versions set to 1.0.0. - CI: the proxy network step is idempotent and the stack is torn down always, since the runner's Docker daemon now outlives a job. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-30 11:36:22 -03:00
Lucas RayanandClaude Sonnet 5.5	c30d618b3f	ci: copy files into containers instead of bind-mounting, patch two advisories ... The job workspace is a volume the DinD daemon cannot see, so migrations and the Trivy filesystem scan now docker cp their inputs. Trivy's image gate flagged next 15.5.27 (unauthenticated RCE in image optimisation, fixed in 15.5.28) and go-jose 4.1.4 (DoS, fixed in 4.1.6); both are patch bumps. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-30 09:22:42 -03:00
Lucas RayanandClaude Sonnet 5.5	e667843b59	feat(webmail): the new interface - logo, dark and light themes, command menu ... A mark (a lambda on an ultramarine tile with the flap of an envelope), the favicon, home-screen icons and an install manifest. Every colour is a variable defined once per theme, and the Tailwind scales the screens already use read them, so dark (the default) and light are a change of values and not of classes. Geist is served by the app itself. Ctrl+K opens a command menu for folders, actions, accounts and appearance, and typing something that matches no command searches the mail; c writes a message and / goes to the search field. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-22 22:33:15 -03:00
Lucas RayanandClaude Sonnet 5.5	dabd1568d1	feat(bimi): logo studio, certificate upload and a setup check in the console ... The console took pasted SVG text and a URL. It now: - takes a PNG or SVG and makes the logo BIMI accepts (SVG Tiny PS, square, at most 32 KB). An SVG has what the format forbids removed and is told what; a PNG is traced into vectors in the browser (imagetracerjs, public domain), walking down quality presets until it fits. The person positions it as in the photo editor: drag, zoom, background colour, preview in a circle or rounded square, and downloads the exact SVG to give a certificate authority - holds the .pem the authority returns, validated against the logo and domain, and serves it at /.well-known/bimi/vmc.pem (routed by the webmail) - shows the DNS record and runs the setup check (logo, DMARC, record, public URLs, certificate) - a golden-file contract: the SVGs the studio produces are validated by the server's own validator (Go) and pinned by the studio's tests (TS) - found by those tests: an element inside a link kept its onclick when the link was unwrapped; links are now unwrapped before cleaning - the BIMI and photo texts are in Brazilian Portuguese with accents (they had been written without), and in Spanish with accents A VMC cannot be generated from an image: it is issued by a certificate authority. The README and the panel say so. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-16 17:04:35 -03:00
Lucas RayanandClaude Sonnet 5.5	931ddcd004	fix(deps): corrige CVEs HIGH/CRITICAL que bloqueavam o release ... O scan Trivy do CI falhou no push anterior e impediu a publicacao das imagens, entao a producao seguiu na versao antiga. - webmail: next 15.5.21 -> 15.5.27 (RCE no otimizador de imagens e cache poisoning), sharp -> 0.35.5, source-map-js -> 1.2.2, dompurify -> 3.4.17 - protocols: golang.org/x/net 0.58 -> 0.60 (DoS HTTP/2) e toolchain Go 1.25 -> 1.26 (stdlib corrigida a partir de 1.26.9) Verificado localmente: imagens e repositorio sem achados HIGH/CRITICAL, testes e build verdes. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-13 10:27:37 -03:00
Lucas Rayan	184769d60f	chore: update dependencies and add trivy ignore file for assessed findings	2026-08-22 08:22:27 -03:00
Lucas RayanandClaude Opus 5	b33fc12f08	#35: replace both web surfaces with the Nocturne redesign ... The webmail was indigo over glass and the console was green over glass, so the two halves of one product did not look related, and neither followed a system anything could be checked against. This replaces the interface with the Nocturne design system from Claude Design: a near-neutral blue-grey ground, Inter at weight 500, solid surfaces with a 1px inset edge instead of blur, and a single blurple accent used as a line, a mark and a glow rather than a flood. The palette is remapped at the source rather than renamed at every call site. tailwind.config.js points slate, indigo, emerald, teal and the rest at the Nocturne ramps, and globals.css carries the same values as variables, so a utility class and a token cannot drift apart and no colour can enter the interface from outside the system. The console's green is gone because it resolves to the one accent; that was the point. Structurally, both surfaces now share one rail - the same brand mark, the same 3px accent mark on the active item, the same account tile - with a segmented control for crossing between them. Crossing into the console still goes to the step-up rather than the admin sign-in, and leaving it is still a plain link. Settings moves from eight stacked panels to a tab strip, so enabling a second factor and writing a filter are no longer separated by everything else. Nothing is sized by the length of its text any more. Labels wrap, tab strips wrap instead of scrolling, subjects and queue diagnostics wrap instead of truncating, and the message list's snippet is clamped to two lines rather than one. That is what broke when the interface was read in Portuguese or Spanish. Defects found while doing it: - The queue and DMARC screens styled their status pills with "badge-danger", "badge-warning" and "badge-verified" - three class names no stylesheet in this project defines - so every verdict rendered as identical unstyled text. They are Badge variants now, which exist. - The DMARC screen printed the literal string "quarantine" as the enforcement level whatever the domains publish. The report endpoint returns no policy at all, so it was asserting a configuration nobody had made. It shows the DMARC pass ratio it genuinely has. - Half the mailboxes screen and two lines of the audit trace were hardcoded strings, some Portuguese and some English, so they stayed in one language whatever the interface was set to. They come from the bundle now, with the new keys added to all three locales. - Avatars printed email[0], so every account at one domain collapsed onto the same letter. initialsFor takes two letters from the local part's own word boundaries, behind tests. Trivy reported one HIGH: nanoid 3.3.16, pulled in transitively by postcss, vulnerable to a denial of service via an infinite loop in ID generation (CVE-2026-67213). Pinned to ^3.3.18 through the overrides block the package already uses for sharp and postcss. Verified: 98 webmail tests green, tsc clean, production build clean, and the compiled stylesheet serves the Nocturne values with no stock Tailwind indigo, emerald or slate hex left in it. Trivy fs with the CI scanners, severities and skip-dirs exits 0. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-18 20:25:24 -03:00
Lucas RayanandClaude Opus 5	ee240ae227	#23: show real data, unify the surfaces and make enrolment scannable ... The interface was reporting things that were not true. Several screens were mockups wired to nothing, and a reader with the console in Portuguese was served a mixture of two languages. Fabricated data, removed: - The outbound queue was two invented jobs held in component state. Retry and Freeze only edited that local array, so the screen showed the same two rows on every deployment and reported success for actions that never happened. "Freeze" named an operation the backend has never implemented. It now reads /api/v1/admin/queue, which was already serving the real thing, and offers retry and cancel, which exist. - Every dashboard KPI fell back to an invented constant (1420 received, 890 sent, 3 queued, 18.4% disk), so an unreachable API produced a dashboard of plausible traffic for a server that might have delivered nothing. Two of those fields were never returned by the endpoint at all, so the fake disk figure was what everyone always saw. DMARC did the same with 1250/98%/97%. - The domains screen showed thirteen DNS records for example.com, all marked VERIFIED, and posted {domain_id: "default-domain"} to endpoints expecting a real id. DKIM rotation sends "domain", not "domain_id", so its 400 was swallowed and a made-up TXT record displayed as though a key had been issued: rotation had never once worked from this screen. - The TLS panel asserted a Let's Encrypt RSA 4096 certificate and verified DANE from static markup, on a deployment currently serving a self-signed one. It now reads the cert watcher via /api/v1/admin/tls. - The readiness scorecard printed "10 / 10 all checks passed" regardless of what preflight reported, including failures. - A message trace that found nothing invented a five-step delivery - TLS 1.3 accepted, SPF pass, spam score 0.8 - for a message that does not exist. - Both sidebars showed a fixed admin@lambdamail.local with a hardcoded "SUPER_ADMIN (2FA)", claiming a second factor whether or not one existed. - Settings seeded a "[Boletim]" Sieve rule. Saving posts the whole list, so the first edit wrote that invented filter into the account's real script. The reconcile endpoint itself answered {records_verified: 13, status: "VERIFIED"} for any domain id, including one that does not exist, without resolving a name. It now reports what it does, which is record the request. Surfaces: The root was a chooser listing webmail and the console side by side, which asked visitors a question they should not have to answer and advertised cookie names and audiences to anonymous readers. It now redirects into the mail client. Accounts that may administer the server get a link to the console from inside the app - a link to /admin/login, so crossing over still costs the second factor the admin audience requires - and the console gets a plain link back, since the webmail session was never given up to get there. Enrolment: Both enrolment screens printed the base32 secret as text and left the operator to type 32 characters into their phone. The enrol endpoint already returned an otpauth:// URI; it simply was not drawn. Added a shared component that renders it as a QR locally - the seed is already in the page, and sending it to an image service would put it in another request log for nothing. The recovery-code step rendered its own "sign in" button while the form's submit button stayed visible below it: two identical buttons, and no way to copy the codes it insisted you save. It is now terminal, with copy and continue. Language: translate() had no interpolation, so "Undo Send ({seconds}s remaining)" showed the placeholder and a second hardcoded countdown was appended after it. It now substitutes, leaving an unmatched token visible rather than blanking it. The pt-BR bundle had lost its diacritics - "Destinatario", "Ultimo erro", "Acoes" - from the ASCII-source rule being applied to the translations, which are data. Restored, and the three bundles are back in key parity at 270 each, with roughly 120 strings that were hardcoded in the source now keyed. Healthchecks: web had none, despite being the only service users reach directly: a wedged Next process kept its container running and Traefik kept routing to it. Added, using node's own fetch since the image ships no curl. rspamd and clamav gained the timeouts and start_periods whose absence would fail them during startup. migrate stays without one and says why: it is a one-shot job, and a probe would report unhealthy exactly when it has succeeded. Verified: 36 webmail tests and 41 auth tests against a real Postgres, both new admin/me cases confirmed to fail without the route (404). lang-lint clean, production build clean, 0 vulnerabilities, compose validates. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-02 19:13:53 -03:00
Lucas RayanandClaude Opus 5	3a82d82428	#22: fix the admin lockout, and the regressions the UI rewrite brought back ... The console demanded a second factor and refused to open without one, but enrolment lived on the other surface - so an operator whose only account was the administrator had no way in. The password was already verified at that point, so the refusal now carries a short-lived grant that permits enrolling a factor and nothing else, and the admin login screen walks through it: secret, confirmation, recovery codes, sign in. Two tests cover it, including that the grant opens no other endpoint. The rewrite also undid work that was already in place: - The postcss override was dropped and the advisory came back, along with a critical one in vitest. postcss is a direct dependency now, so the fix is the version plus an override scoped to Next's own copy; vitest moves to 3.2.7. The lockfile needed regenerating for either to take effect. Zero advisories now. - 100 language-lint violations: the admin console had been rewritten with its strings in Portuguese, hardcoded. That fails CI, and it also puts those strings beyond the reach of the translation bundles - an English or Spanish user would have read Portuguese. They are English in the source again. - The mail screen put a fixed 320px list beside the reader with no breakpoint, so on a phone the viewport overflowed and the message was a few pixels wide. One pane at a time below md, with a way back. - The icon-only navigation toggles had nothing for a screen reader to announce. The layouts' own mobile navigation and every previously fixed behaviour survived the rewrite - checked rather than assumed. Also fixes a marker collision I introduced: the E2E helper locates the repository by a migrations directory, and services/migrations satisfied that one directory too early. It now requires the SQL to actually be there. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-02 16:13:14 -03:00
Lucas RayanandClaude Opus 5	30014f0f41	#21: fix the DKIM, onboarding and console defects found reviewing the new work ... DKIM rotation broke the domain it was run on. It retired the live key and inserted a placeholder as ACTIVE - private_key_enc was the literal string "dummy-encrypted-key" - so FindActiveKeys then failed for the whole domain and outbound mail stopped being signed, with the real key already gone. Reproduced against a database before changing anything. The root cause runs deeper: the auth service derives its encryption key with a plain SHA-256 of the master key while the protocols service uses HKDF with its own info string, so nothing the auth service seals can ever be opened by the signer. Rotation therefore moves to the protocols service, which owns that vault and the real key generator. It retires the previous key with a seven-day overlap in the same transaction rather than deleting it, because mail already sent under it is still being verified. Domain onboarding had three defects in one function. It built the alias destination by interpolating the domain name into the SQL text, which was injectable; it reused one placeholder for a CITEXT and a VARCHAR column, which made the statement fail and happened to hide the injection; and it ignored its scope argument entirely, so any DOMAIN_ADMIN could create domains. It also provisioned postmaster, abuse and security, missing the dmarc and tlsrpt aliases that the published records point at - PLAN.md section 7.4b is explicit that reports bounce without them. The TLS panel returned fixed values: acme_status "VALID" and 72 days to expiry, whatever the process actually held. It now reads the certificate watcher, and a compile-time assertion keeps the wiring from silently regressing into "disabled". The audit log and the readiness scorecard were fixtures too, and their field names did not match the API they now read. Two tests failed and a third asserted a fabricated constant: one depended on test order through a shared fixture that had a second factor enrolled, one used a fixed domain name and so passed once per database, and one expected "records: 13" from a function that never touches DNS. All three are fixed, and the suite now passes twice in a row against one database. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-02 13:33:33 -03:00
Lucas Rayan	56a176d1f0	#21: enhance webmail with rich-text editor, DOMPurify sanitizer, attachments, sieve builder, and vacation responder	2026-08-02 10:37:03 -03:00
Lucas RayanandClaude Opus 5	132cecd41c	#21: guard the web surfaces and connect them to the auth service ... Three separate gaps, all of which made the F4 interface non-functional or unprotected: The admin console rendered for anyone. There was no middleware and no guard in the layout, so /admin/dashboard returned 200 unauthenticated - only its data calls failed. middleware.ts now redirects both surfaces to their login when the session cookie is missing, expired, carries the wrong audience, or is a pre-MFA challenge token. It reads the claims without verifying the signature on purpose: the signing key belongs to the auth service and must not reach the browser bundle. That is sound because this is not the boundary - every /api/v1 request is verified for real upstream. Nothing served /api/v1/*. next.config.ts had no rewrites and there were no route handlers, so every call the pages made 404'd against the Next server, while AUTH_SERVICE_URL sat unused. A catch-all route now proxies to the auth service, forwarding the client address and preserving multiple Set-Cookie headers, which logout needs to clear both surfaces. Session cookies also move to Path=/, since a cookie pinned to /user or /admin was never sent with the /api/v1 requests that needed it. i18n existed only as files. The three bundles had perfect key parity and real translations, but no library, no imports and no switcher: the UI was hardcoded English and i18n.test.ts compared keys while the feature was absent. There is now a provider, a hook, a language switcher, and server-side Accept-Language negotiation that honours q-values and matches a bare "pt" to pt-BR. Logins, both layouts and the settings screen consume it; the admin pages still have English titles. The settings screen invented app passwords in the browser with Math.random and never stored them. It now calls the API, which returns the password once and keeps only its hash. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-02 09:33:49 -03:00
Lucas Rayan	6e01fc7ffb	#20: implement F4 webmail, admin console, 2FA TOTP, surface isolation, and i18n	2026-08-02 08:39:00 -03:00
Lucas RayanandClaude Opus 5	46d421c874	#19: add Trivy scanning and multi-architecture GHCR publishing ... CI gains a security job (Trivy fs: vuln, secret and misconfig) and an image job that builds each of the four services and scans the result. The secret scanner earns its place here: a DKIM key or Cloudflare token committed by accident is a full compromise of every domain served. release.yml publishes on a merge into main and on v* tags. Four services on two architectures is eight build jobs pushing by digest, then four publish jobs joining each pair into one manifest list, tagged latest, sha and semver. github.repository is lowercased first because GHCR rejects an uppercase path and this repository is lucasrguerra/LambdaMail. Both scanners failed on first run, so this commit also fixes what they found rather than shipping a workflow that is red on arrival: - All four images ran as root (DS-0002), which section 17 risk R5 explicitly argues against. They now run unprivileged; protocols keeps its eight ports below 1024 through cap_net_bind_service on the binary rather than through being root. - A HIGH advisory in postcss, reached only through Next. "npm audit fix --force" would have resolved it by downgrading Next from 15 to 9, so it is pinned with an override instead. - The Node images copied the build stage's node_modules wholesale, shipping typescript, eslint and vitest into production, and the base image's own bundled npm accounted for the rest of the CVEs. Runtime dependencies now come from npm ci --omit=dev and npm is removed from the final layer. - compose-up could never have passed: the proxy network is external because Coolify owns it on the deploy host, and nothing creates it in CI, so compose refused to start the stack at all. Verified locally: actionlint clean, all ten action refs confirmed to exist, Trivy fs and all four image scans exit 0, the full stack reaches Healthy on every container, and the containers run as uid 10001/1000 with all eight privileged ports bound and SMTP answering on 25. The arm64 build itself is unverified - this machine has no buildx - and will first be exercised by release.yml. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-02 07:58:02 -03:00
Lucas Rayan	eb09fa0ced	#1: implement F0 foundation - monorepo, migrations, Go domain layer, service skeletons, CI ... Stands up the LambdaMail monorepo per PLAN.md's F0 milestone: local dev scaffolding (.env.example, Makefile, .gitignore excluding PLAN.md/docs/ .superpowers/), the full initial Postgres schema as a golang-migrate migration, the complete Go domain layer for services/protocols (value objects, entities, domain events - zero external imports beyond github.com/google/uuid) with unit tests, health-checked service skeletons for auth/storage (TypeScript) and webmail (Next.js), a local docker-compose.yaml wiring all services together, a language-enforcement lint script, and a GitHub Actions CI workflow. Built via 11 sequential tasks under subagent-driven development, each with an independent implementer + reviewer cycle. Fixes applied during review: DomainName.IsPunycode() added to satisfy the promised interface; ioredis default-import typing under NodeNext; next.js bumped 15.0.3->15.5.21 to resolve high/critical CVEs; lang-lint.mjs corrected to not flag its own banned-terms list; web service healthcheck added so compose --wait actually waits on it; webmail Dockerfile's missing public/ directory: protocols go.mod version aligned with CI's Go 1.22 pin. Known follow-ups for later phases (not blocking F0): go-arch-lint isn't wired into CI yet; live docker compose up and migration apply have not been exercised in this dev environment (no Docker/psql available here) and will get their first real run in CI, which does have Docker.	2026-07-23 05:05:46 -03:00