LambdaMail

75 Commits 1 Branch 1 Tag

3 Commits

Include renames

Author	SHA1	Message	Date
Lucas RayanandClaude Opus 5	ee240ae227	#23 : show real data, unify the surfaces and make enrolment scannable The interface was reporting things that were not true. Several screens were mockups wired to nothing, and a reader with the console in Portuguese was served a mixture of two languages. Fabricated data, removed: - The outbound queue was two invented jobs held in component state. Retry and Freeze only edited that local array, so the screen showed the same two rows on every deployment and reported success for actions that never happened. "Freeze" named an operation the backend has never implemented. It now reads /api/v1/admin/queue, which was already serving the real thing, and offers retry and cancel, which exist. - Every dashboard KPI fell back to an invented constant (1420 received, 890 sent, 3 queued, 18.4% disk), so an unreachable API produced a dashboard of plausible traffic for a server that might have delivered nothing. Two of those fields were never returned by the endpoint at all, so the fake disk figure was what everyone always saw. DMARC did the same with 1250/98%/97%. - The domains screen showed thirteen DNS records for example.com, all marked VERIFIED, and posted {domain_id: "default-domain"} to endpoints expecting a real id. DKIM rotation sends "domain", not "domain_id", so its 400 was swallowed and a made-up TXT record displayed as though a key had been issued: rotation had never once worked from this screen. - The TLS panel asserted a Let's Encrypt RSA 4096 certificate and verified DANE from static markup, on a deployment currently serving a self-signed one. It now reads the cert watcher via /api/v1/admin/tls. - The readiness scorecard printed "10 / 10 all checks passed" regardless of what preflight reported, including failures. - A message trace that found nothing invented a five-step delivery - TLS 1.3 accepted, SPF pass, spam score 0.8 - for a message that does not exist. - Both sidebars showed a fixed admin@lambdamail.local with a hardcoded "SUPER_ADMIN (2FA)", claiming a second factor whether or not one existed. - Settings seeded a "[Boletim]" Sieve rule. Saving posts the whole list, so the first edit wrote that invented filter into the account's real script. The reconcile endpoint itself answered {records_verified: 13, status: "VERIFIED"} for any domain id, including one that does not exist, without resolving a name. It now reports what it does, which is record the request. Surfaces: The root was a chooser listing webmail and the console side by side, which asked visitors a question they should not have to answer and advertised cookie names and audiences to anonymous readers. It now redirects into the mail client. Accounts that may administer the server get a link to the console from inside the app - a link to /admin/login, so crossing over still costs the second factor the admin audience requires - and the console gets a plain link back, since the webmail session was never given up to get there. Enrolment: Both enrolment screens printed the base32 secret as text and left the operator to type 32 characters into their phone. The enrol endpoint already returned an otpauth:// URI; it simply was not drawn. Added a shared component that renders it as a QR locally - the seed is already in the page, and sending it to an image service would put it in another request log for nothing. The recovery-code step rendered its own "sign in" button while the form's submit button stayed visible below it: two identical buttons, and no way to copy the codes it insisted you save. It is now terminal, with copy and continue. Language: translate() had no interpolation, so "Undo Send ({seconds}s remaining)" showed the placeholder and a second hardcoded countdown was appended after it. It now substitutes, leaving an unmatched token visible rather than blanking it. The pt-BR bundle had lost its diacritics - "Destinatario", "Ultimo erro", "Acoes" - from the ASCII-source rule being applied to the translations, which are data. Restored, and the three bundles are back in key parity at 270 each, with roughly 120 strings that were hardcoded in the source now keyed. Healthchecks: web had none, despite being the only service users reach directly: a wedged Next process kept its container running and Traefik kept routing to it. Added, using node's own fetch since the image ships no curl. rspamd and clamav gained the timeouts and start_periods whose absence would fail them during startup. migrate stays without one and says why: it is a one-shot job, and a probe would report unhealthy exactly when it has succeeded. Verified: 36 webmail tests and 41 auth tests against a real Postgres, both new admin/me cases confirmed to fail without the route (404). lang-lint clean, production build clean, 0 vulnerabilities, compose validates. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-02 19:13:53 -03:00
Lucas RayanandClaude Opus 5	3e60852551	#21 : put real mail on the webmail screens The mail list rendered two hardcoded messages and the reader showed their canned HTML; compose ran a countdown and then navigated away without ever submitting anything. Both now use the API, including search, the unread badges in the sidebar (which were the literals "3" and "1", so an empty inbox still advertised unread mail), and marking a message read on open. The undo window now means what it says: the message is held in the browser and only submitted when the countdown elapses, so cancelling it means nothing was ever queued rather than trying to recall it afterwards. Message bodies render in an iframe with an empty sandbox - no scripts, no same-origin - and remote references are stripped until the reader asks for images, so a tracking pixel cannot fire on open. The previous sandbox allowed popups. The admin page titles and the language switcher labels now come from the bundles. The labels live there rather than in the source because PLAN.md R9 keeps non-ASCII out of code, and each language should be named the way that language names it. ADR-001 assigned the mail API to the TypeScript storage service; the reasoning for putting it in Go instead is recorded in PLAN.md, which .gitignore deliberately keeps out of the repository, so that revision lives only in the working copy. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-02 10:04:05 -03:00
Lucas RayanandClaude Opus 5	132cecd41c	#21 : guard the web surfaces and connect them to the auth service Three separate gaps, all of which made the F4 interface non-functional or unprotected: The admin console rendered for anyone. There was no middleware and no guard in the layout, so /admin/dashboard returned 200 unauthenticated - only its data calls failed. middleware.ts now redirects both surfaces to their login when the session cookie is missing, expired, carries the wrong audience, or is a pre-MFA challenge token. It reads the claims without verifying the signature on purpose: the signing key belongs to the auth service and must not reach the browser bundle. That is sound because this is not the boundary - every /api/v1 request is verified for real upstream. Nothing served /api/v1/*. next.config.ts had no rewrites and there were no route handlers, so every call the pages made 404'd against the Next server, while AUTH_SERVICE_URL sat unused. A catch-all route now proxies to the auth service, forwarding the client address and preserving multiple Set-Cookie headers, which logout needs to clear both surfaces. Session cookies also move to Path=/, since a cookie pinned to /user or /admin was never sent with the /api/v1 requests that needed it. i18n existed only as files. The three bundles had perfect key parity and real translations, but no library, no imports and no switcher: the UI was hardcoded English and i18n.test.ts compared keys while the feature was absent. There is now a provider, a hook, a language switcher, and server-side Accept-Language negotiation that honours q-values and matches a bare "pt" to pt-BR. Logins, both layouts and the settings screen consume it; the admin pages still have English titles. The settings screen invented app passwords in the browser with Math.random and never stored them. It now calls the API, which returns the password once and keeps only its hash. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-02 09:33:49 -03:00

Author

SHA1

Message

Date

Lucas RayanandClaude Opus 5

ee240ae227

#23 : show real data, unify the surfaces and make enrolment scannable

The interface was reporting things that were not true. Several screens were
mockups wired to nothing, and a reader with the console in Portuguese was
served a mixture of two languages.

Fabricated data, removed:

- The outbound queue was two invented jobs held in component state. Retry and
  Freeze only edited that local array, so the screen showed the same two rows
  on every deployment and reported success for actions that never happened.
  "Freeze" named an operation the backend has never implemented. It now reads
  /api/v1/admin/queue, which was already serving the real thing, and offers
  retry and cancel, which exist.
- Every dashboard KPI fell back to an invented constant (1420 received, 890
  sent, 3 queued, 18.4% disk), so an unreachable API produced a dashboard of
  plausible traffic for a server that might have delivered nothing. Two of
  those fields were never returned by the endpoint at all, so the fake disk
  figure was what everyone always saw. DMARC did the same with 1250/98%/97%.
- The domains screen showed thirteen DNS records for example.com, all marked
  VERIFIED, and posted {domain_id: "default-domain"} to endpoints expecting a
  real id. DKIM rotation sends "domain", not "domain_id", so its 400 was
  swallowed and a made-up TXT record displayed as though a key had been
  issued: rotation had never once worked from this screen.
- The TLS panel asserted a Let's Encrypt RSA 4096 certificate and verified
  DANE from static markup, on a deployment currently serving a self-signed
  one. It now reads the cert watcher via /api/v1/admin/tls.
- The readiness scorecard printed "10 / 10 all checks passed" regardless of
  what preflight reported, including failures.
- A message trace that found nothing invented a five-step delivery - TLS 1.3
  accepted, SPF pass, spam score 0.8 - for a message that does not exist.
- Both sidebars showed a fixed admin@lambdamail.local with a hardcoded
  "SUPER_ADMIN (2FA)", claiming a second factor whether or not one existed.
- Settings seeded a "[Boletim]" Sieve rule. Saving posts the whole list, so
  the first edit wrote that invented filter into the account's real script.

The reconcile endpoint itself answered {records_verified: 13, status:
"VERIFIED"} for any domain id, including one that does not exist, without
resolving a name. It now reports what it does, which is record the request.

Surfaces:

The root was a chooser listing webmail and the console side by side, which
asked visitors a question they should not have to answer and advertised cookie
names and audiences to anonymous readers. It now redirects into the mail
client. Accounts that may administer the server get a link to the console from
inside the app - a link to /admin/login, so crossing over still costs the
second factor the admin audience requires - and the console gets a plain link
back, since the webmail session was never given up to get there.

Enrolment:

Both enrolment screens printed the base32 secret as text and left the operator
to type 32 characters into their phone. The enrol endpoint already returned an
otpauth:// URI; it simply was not drawn. Added a shared component that renders
it as a QR locally - the seed is already in the page, and sending it to an
image service would put it in another request log for nothing.

The recovery-code step rendered its own "sign in" button while the form's
submit button stayed visible below it: two identical buttons, and no way to
copy the codes it insisted you save. It is now terminal, with copy and
continue.

Language:

translate() had no interpolation, so "Undo Send ({seconds}s remaining)" showed
the placeholder and a second hardcoded countdown was appended after it. It now
substitutes, leaving an unmatched token visible rather than blanking it.

The pt-BR bundle had lost its diacritics - "Destinatario", "Ultimo erro",
"Acoes" - from the ASCII-source rule being applied to the translations, which
are data. Restored, and the three bundles are back in key parity at 270 each,
with roughly 120 strings that were hardcoded in the source now keyed.

Healthchecks:

web had none, despite being the only service users reach directly: a wedged
Next process kept its container running and Traefik kept routing to it. Added,
using node's own fetch since the image ships no curl. rspamd and clamav gained
the timeouts and start_periods whose absence would fail them during startup.
migrate stays without one and says why: it is a one-shot job, and a probe
would report unhealthy exactly when it has succeeded.

Verified: 36 webmail tests and 41 auth tests against a real Postgres, both new
admin/me cases confirmed to fail without the route (404). lang-lint clean,
production build clean, 0 vulnerabilities, compose validates.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-08-02 19:13:53 -03:00

Lucas RayanandClaude Opus 5

3e60852551

#21 : put real mail on the webmail screens

The mail list rendered two hardcoded messages and the reader showed their
canned HTML; compose ran a countdown and then navigated away without ever
submitting anything. Both now use the API, including search, the unread
badges in the sidebar (which were the literals "3" and "1", so an empty
inbox still advertised unread mail), and marking a message read on open.

The undo window now means what it says: the message is held in the browser
and only submitted when the countdown elapses, so cancelling it means
nothing was ever queued rather than trying to recall it afterwards.

Message bodies render in an iframe with an empty sandbox - no scripts, no
same-origin - and remote references are stripped until the reader asks for
images, so a tracking pixel cannot fire on open. The previous sandbox
allowed popups.

The admin page titles and the language switcher labels now come from the
bundles. The labels live there rather than in the source because PLAN.md
R9 keeps non-ASCII out of code, and each language should be named the way
that language names it.

ADR-001 assigned the mail API to the TypeScript storage service; the
reasoning for putting it in Go instead is recorded in PLAN.md, which
.gitignore deliberately keeps out of the repository, so that revision
lives only in the working copy.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-08-02 10:04:05 -03:00

Lucas RayanandClaude Opus 5

132cecd41c

#21 : guard the web surfaces and connect them to the auth service

Three separate gaps, all of which made the F4 interface non-functional or
unprotected:

The admin console rendered for anyone. There was no middleware and no
guard in the layout, so /admin/dashboard returned 200 unauthenticated -
only its data calls failed. middleware.ts now redirects both surfaces to
their login when the session cookie is missing, expired, carries the wrong
audience, or is a pre-MFA challenge token. It reads the claims without
verifying the signature on purpose: the signing key belongs to the auth
service and must not reach the browser bundle. That is sound because this
is not the boundary - every /api/v1 request is verified for real upstream.

Nothing served /api/v1/*. next.config.ts had no rewrites and there were no
route handlers, so every call the pages made 404'd against the Next
server, while AUTH_SERVICE_URL sat unused. A catch-all route now proxies
to the auth service, forwarding the client address and preserving multiple
Set-Cookie headers, which logout needs to clear both surfaces. Session
cookies also move to Path=/, since a cookie pinned to /user or /admin was
never sent with the /api/v1 requests that needed it.

i18n existed only as files. The three bundles had perfect key parity and
real translations, but no library, no imports and no switcher: the UI was
hardcoded English and i18n.test.ts compared keys while the feature was
absent. There is now a provider, a hook, a language switcher, and
server-side Accept-Language negotiation that honours q-values and matches
a bare "pt" to pt-BR. Logins, both layouts and the settings screen consume
it; the admin pages still have English titles.

The settings screen invented app passwords in the browser with Math.random
and never stored them. It now calls the API, which returns the password
once and keeps only its hash.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-08-02 09:33:49 -03:00