feat: implement Stalwart admin authentication and role check across admin routes

app/admin/layout.tsx

@@ -19,6 +19,8 @@ import { cn } from '@/lib/utils';
 import { useConfig } from '@/hooks/use-config';
 import { useThemeStore } from '@/stores/theme-store';
 
+import { useAuthStore } from '@/stores/auth-store';
+
 const NAV_GROUPS = [
   {
     label: 'Overview',
@@ -54,6 +56,7 @@ export default function AdminLayout({ children }: { children: React.ReactNode })
   const router = useRouter();
   const pathname = usePathname();
   const [authenticated, setAuthenticated] = useState<boolean | null>(null);
+  const [isStalwartAdmin, setIsStalwartAdmin] = useState(false);
   const { appLogoLightUrl, appLogoDarkUrl, loginLogoLightUrl, loginLogoDarkUrl } = useConfig();
   const resolvedTheme = useThemeStore((s) => s.resolvedTheme);
   const logoUrl = resolvedTheme === 'dark'
@@ -67,19 +70,50 @@ export default function AdminLayout({ children }: { children: React.ReactNode })
   // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [pathname]);
 
+  function getJmapHeaders(): Record<string, string> {
+    const client = useAuthStore.getState().client;
+    if (!client) return {};
+    return {
+      'Authorization': client.getAuthHeader(),
+      'X-JMAP-Server-URL': client.getServerUrl(),
+      'X-JMAP-Username': client.getUsername(),
+    };
+  }
+
   async function checkAuth() {
     try {
-      const res = await fetch('/api/admin/auth');
+      const jmapHeaders = getJmapHeaders();
+      const res = await fetch('/api/admin/auth', { headers: jmapHeaders });
       const data = await res.json();
-      if (!data.enabled) {
+
+      const stalwartAdmin = data.stalwartAdmin === true;
+      setIsStalwartAdmin(stalwartAdmin);
+
+      // If neither password-based admin nor Stalwart admin, redirect away
+      if (!data.enabled && !stalwartAdmin) {
         router.replace('/');
         return;
       }
-      if (!data.authenticated) {
+
-        router.replace('/admin/login');
+      if (data.authenticated) {
+        setAuthenticated(true);
         return;
       }
-      setAuthenticated(true);
+
+      // If Stalwart admin but not yet authenticated, auto-login
+      if (stalwartAdmin) {
+        const loginRes = await fetch('/api/admin/auth', {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json', ...jmapHeaders },
+          body: JSON.stringify({ stalwartAuth: true }),
+        });
+        if (loginRes.ok) {
+          setAuthenticated(true);
+          return;
+        }
+      }
+
+      router.replace('/admin/login');
     } catch {
       router.replace('/admin/login');
     }
@@ -153,21 +187,23 @@ export default function AdminLayout({ children }: { children: React.ReactNode })
         </div>
 
         <div className="px-2 py-2 border-t border-border space-y-0.5 shrink-0">
-          <Link
+          {!isStalwartAdmin && (
-            href="/admin/change-password"
+            <Link
-            className={cn(
+              href="/admin/change-password"
-              'w-full text-left px-3 py-2 rounded-md text-sm transition-colors duration-150 flex items-center gap-2.5',
+              className={cn(
-              pathname === '/admin/change-password'
+                'w-full text-left px-3 py-2 rounded-md text-sm transition-colors duration-150 flex items-center gap-2.5',
-                ? 'bg-accent text-accent-foreground font-medium'
+                pathname === '/admin/change-password'
-                : 'hover:bg-muted text-foreground'
+                  ? 'bg-accent text-accent-foreground font-medium'
-            )}
+                  : 'hover:bg-muted text-foreground'
-          >
+              )}
-            <KeyRound className={cn(
+            >
-              'w-4 h-4 shrink-0',
+              <KeyRound className={cn(
+                'w-4 h-4 shrink-0',
               pathname === '/admin/change-password' ? 'text-accent-foreground' : 'text-muted-foreground'
             )} />
             Change Password
           </Link>
+          )}
           <button
             onClick={handleLogout}
             className="w-full text-left px-3 py-2 rounded-md text-sm transition-colors duration-150 flex items-center gap-2.5 hover:bg-muted text-foreground"

app/api/admin/auth/route.ts

@@ -4,19 +4,58 @@ import { setAdminSessionCookie, clearAdminSessionCookie, requireAdminAuth, getCl
 import { checkRateLimit } from '@/lib/admin/rate-limit';
 import { auditLog } from '@/lib/admin/audit';
 import { logger } from '@/lib/logger';
+import { getStalwartCredentials } from '@/lib/stalwart/credentials';
+
+/**
+ * Check if the current user is a Stalwart admin via principal roles.
+ */
+async function checkStalwartAdmin(request: NextRequest): Promise<boolean> {
+  try {
+    const creds = await getStalwartCredentials(request);
+    if (!creds) return false;
+
+    const response = await fetch(
+      `${creds.apiUrl}/api/principal/${encodeURIComponent(creds.username)}`,
+      { method: 'GET', headers: { 'Authorization': creds.authHeader } }
+    );
+    if (!response.ok) return false;
+
+    const data = await response.json();
+    const principal = data.data ?? data;
+    const roles: string[] = Array.isArray(principal?.roles) ? principal.roles : [];
+    return roles.includes('admin');
+  } catch {
+    return false;
+  }
+}
 
 /**
  * POST /api/admin/auth — Login
  */
 export async function POST(request: NextRequest) {
   try {
+    const ip = getClientIP(request);
+    const body = await request.json();
+
+    // Stalwart-based admin authentication
+    if (body.stalwartAuth === true) {
+      const isStalwartAdmin = await checkStalwartAdmin(request);
+      if (!isStalwartAdmin) {
+        await auditLog('admin.login_failed', { method: 'stalwart' }, ip);
+        return NextResponse.json({ error: 'Not a Stalwart admin' }, { status: 403 });
+      }
+
+      await setAdminSessionCookie();
+      await auditLog('admin.login', { method: 'stalwart' }, ip);
+      return NextResponse.json({ ok: true });
+    }
+
+    // Password-based admin authentication
     await initAdminPassword();
     if (!isAdminEnabled()) {
       return NextResponse.json({ error: 'Admin dashboard is not configured' }, { status: 404 });
     }
 
-    const ip = getClientIP(request);
-
     // Rate limit check
     const limit = checkRateLimit(ip);
     if (!limit.allowed) {
@@ -28,7 +67,6 @@ export async function POST(request: NextRequest) {
       );
     }
 
-    const body = await request.json();
     const { password } = body;
 
     if (!password || typeof password !== 'string') {
@@ -55,27 +93,37 @@ export async function POST(request: NextRequest) {
 
 /**
  * GET /api/admin/auth — Check session status
+ * Also checks if the user is a Stalwart admin (admin panel enabled even without password).
  */
-export async function GET() {
+export async function GET(request: NextRequest) {
   try {
     await initAdminPassword();
-    if (!isAdminEnabled()) {
+    const adminEnabled = isAdminEnabled();
-      return NextResponse.json({ enabled: false, authenticated: false }, {
+    const isStalwartAdmin = await checkStalwartAdmin(request);
+
+    // If neither password-based admin nor Stalwart admin, admin is disabled
+    if (!adminEnabled && !isStalwartAdmin) {
+      return NextResponse.json({ enabled: false, authenticated: false, stalwartAdmin: false }, {
         headers: { 'Cache-Control': 'no-store' },
       });
     }
 
     const result = await requireAdminAuth();
     if ('error' in result) {
-      return NextResponse.json({ enabled: true, authenticated: false }, {
+      return NextResponse.json({
+        enabled: adminEnabled,
+        authenticated: false,
+        stalwartAdmin: isStalwartAdmin,
+      }, {
         headers: { 'Cache-Control': 'no-store' },
       });
     }
 
     const meta = getAdminMeta();
     return NextResponse.json({
-      enabled: true,
+      enabled: adminEnabled,
       authenticated: true,
+      stalwartAdmin: isStalwartAdmin,
       lastLogin: meta?.lastLogin,
       passwordChangedAt: meta?.passwordChangedAt,
     }, {

app/api/admin/stalwart-check/route.ts

@@ -0,0 +1,49 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { logger } from '@/lib/logger';
+import { getStalwartCredentials } from '@/lib/stalwart/credentials';
+
+/**
+ * GET /api/admin/stalwart-check
+ * Check if the currently logged-in user has the 'admin' role in Stalwart.
+ * Uses the user's JMAP session credentials.
+ */
+export async function GET(request: NextRequest) {
+  try {
+    const creds = await getStalwartCredentials(request);
+    if (!creds) {
+      return NextResponse.json({ isStalwartAdmin: false }, {
+        headers: { 'Cache-Control': 'no-store' },
+      });
+    }
+
+    const response = await fetch(
+      `${creds.apiUrl}/api/principal/${encodeURIComponent(creds.username)}`,
+      {
+        method: 'GET',
+        headers: { 'Authorization': creds.authHeader },
+      }
+    );
+
+    if (!response.ok) {
+      return NextResponse.json({ isStalwartAdmin: false }, {
+        headers: { 'Cache-Control': 'no-store' },
+      });
+    }
+
+    const data = await response.json();
+    const principal = data.data ?? data;
+    const roles: string[] = Array.isArray(principal?.roles) ? principal.roles : [];
+    const isStalwartAdmin = roles.includes('admin');
+
+    return NextResponse.json({ isStalwartAdmin }, {
+      headers: { 'Cache-Control': 'no-store' },
+    });
+  } catch (error) {
+    logger.error('Stalwart admin check error', {
+      error: error instanceof Error ? error.message : 'Unknown',
+    });
+    return NextResponse.json({ isStalwartAdmin: false }, {
+      headers: { 'Cache-Control': 'no-store' },
+    });
+  }
+}

locales/de/common.json

@@ -75,6 +75,7 @@
     "contacts": "Kontakte",
     "calendar": "Kalender",
     "settings": "Einstellungen",
+    "admin": "Admin",
     "files": "Dateien",
     "loading_mailboxes": "Postfächer werden geladen...",
     "push_connected": "Echtzeit-Updates aktiv",

locales/en/common.json

@@ -75,6 +75,7 @@
     "contacts": "Contacts",
     "calendar": "Calendar",
     "settings": "Settings",
+    "admin": "Admin",
     "files": "Files",
     "loading_mailboxes": "Loading mailboxes...",
     "push_connected": "Real-time updates active",

locales/es/common.json

@@ -75,6 +75,7 @@
     "contacts": "Contactos",
     "calendar": "Calendario",
     "settings": "Configuración",
+    "admin": "Admin",
     "files": "Archivos",
     "loading_mailboxes": "Cargando buzones...",
     "push_connected": "Actualizaciones en tiempo real activas",

locales/fr/common.json

@@ -75,6 +75,7 @@
     "contacts": "Contacts",
     "calendar": "Calendrier",
     "settings": "Paramètres",
+    "admin": "Admin",
     "files": "Fichiers",
     "loading_mailboxes": "Chargement des boîtes mail...",
     "push_connected": "Mises à jour en temps réel actives",

locales/it/common.json

@@ -75,6 +75,7 @@
     "contacts": "Contatti",
     "calendar": "Calendario",
     "settings": "Impostazioni",
+    "admin": "Admin",
     "files": "File",
     "loading_mailboxes": "Caricamento caselle di posta...",
     "push_connected": "Aggiornamenti in tempo reale attivi",

locales/ja/common.json

@@ -75,6 +75,7 @@
     "contacts": "連絡先",
     "calendar": "カレンダー",
     "settings": "設定",
+    "admin": "管理",
     "files": "ファイル",
     "loading_mailboxes": "メールボックスを読み込み中...",
     "push_connected": "リアルタイム更新が有効",

locales/nl/common.json

@@ -75,6 +75,7 @@
     "contacts": "Contacten",
     "calendar": "Agenda",
     "settings": "Instellingen",
+    "admin": "Admin",
     "files": "Bestanden",
     "loading_mailboxes": "Mappen laden...",
     "push_connected": "Real-time updates actief",

locales/pt/common.json

@@ -75,6 +75,7 @@
     "contacts": "Contatos",
     "calendar": "Calendário",
     "settings": "Configurações",
+    "admin": "Admin",
     "files": "Ficheiros",
     "loading_mailboxes": "Carregando caixas de entrada...",
     "push_connected": "Atualizações em tempo real ativas",

locales/ru/common.json

@@ -75,6 +75,7 @@
     "contacts": "Контакты",
     "calendar": "Календарь",
     "settings": "Настройки",
+    "admin": "Админ",
     "files": "Файлы",
     "loading_mailboxes": "Загрузка папок...",
     "push_connected": "Обновления в реальном времени активны",