feat(unified-mailbox): account-bounded Unified Mailbox with opt-in cross-account
Rework the sidebar "All accounts" section into a "Unified Mailbox" that, by default, stays within the active login account and its shared/group folders. Merging across multiple logged-in accounts becomes an opt-in sub-option instead of the default, and the standalone per-account "All Mail" virtual folder is folded into the unified All mail / Unread / Starred entries (its folder selection now narrows those lists). Scope: - lib/unified-mailbox.ts: UnifiedAccountClient.crossIncludedMailboxIds; the cross views honor the per-account folder selection (union across accounts = the sum of each account's selection), falling back to inbox+custom when unset. - stores/email-store.ts: buildUnifiedAccountClients gains scopeToClientAccountId (the account boundary) and populates crossIncludedMailboxIds from allMailFolderIds; remove the standalone __all_mail__ fetch/search/load-more branches. - page.tsx: scope to the active account unless cross-account is active (per-user opt-in AND admin gate); the per-role unified mailboxes obey the same scope. Folding: - Drop ALL_MAIL_MAILBOX_ID (lib/jmap/types.ts); thread-list source-folder column now keys on isUnifiedView only; settings folder picker moves under the unified group and shows once any unified entry is enabled. Config: - User: new unifiedCrossAccount (default false); includeGroupInUnified default flips to true; enableAllMailView retired; the three cross-view toggles now gate the unified Unread/Starred/All mail entries. - Admin: new unifiedCrossAccountEnabled gate, default FALSE (cross-account is an admin opt-in; when off the per-user toggle is hidden and the scope is forced account-bounded at runtime). allMailViewEnabled deprecated and normalized forward into crossAllViewEnabled on policy load; cross-view gate labels reworded to "Unified Mailbox: ...". Header: the sidebar section shows "All accounts" when cross-account is active (opt-in AND admin gate AND >1 connected account), else "Unified Mailbox". Migration: - Settings persist v5 -> v6 (exported migrateSettings) - cross-active users keep cross-account; All-Mail-only users get the account-bounded unified All mail entry with folder ids preserved; includeGroupInUnified enabled for every migrated config; fresh installs are account-bounded. - Admin policy: one-shot, marker-guarded migratePolicyUnifiedMailbox (run before configManager.load) enables unifiedCrossAccountEnabled when a cross view was active, so existing cross-account installs keep the behaviour despite the default-false gate. Skipped on read-only config dirs. Locales: sidebar all_accounts (original label) + unified_mailbox (translated, per locale) keys; dead standalone all_mail strings removed across all 20 locales. Docs: FEATURES.md updated to the account-bounded model, the cross-account gate, and the folder-narrowed aggregate entries. Verification: tsc clean, eslint clean, full vitest suite green (incl. translations completeness, cross-view/migration coverage, and the admin policy migration test).
This commit is contained in:
Stefan Hildebrandt
@@ -0,0 +1,59 @@
|
||||
import { describe, it, expect, beforeEach, afterEach } from 'vitest';
|
||||
import { mkdtemp, rm, readFile, writeFile } from 'node:fs/promises';
|
||||
import { existsSync } from 'node:fs';
|
||||
import { tmpdir } from 'node:os';
|
||||
import path from 'node:path';
|
||||
import { migratePolicyUnifiedMailbox } from '../migrate';
|
||||
|
||||
// migratePolicyUnifiedMailbox reads ADMIN_CONFIG_DIR at call time (see paths.ts),
|
||||
// so each test points it at a fresh temp dir.
|
||||
let dir: string;
|
||||
const policyPath = () => path.join(dir, 'policy.json');
|
||||
const markerPath = () => path.join(dir, '.migrated-unified-mailbox');
|
||||
|
||||
const writePolicy = (features: Record<string, unknown>) =>
|
||||
writeFile(policyPath(), JSON.stringify({ features, restrictions: {} }, null, 2), 'utf-8');
|
||||
const readFeatures = async () =>
|
||||
JSON.parse(await readFile(policyPath(), 'utf-8')).features as Record<string, unknown>;
|
||||
|
||||
beforeEach(async () => {
|
||||
dir = await mkdtemp(path.join(tmpdir(), 'bw-policy-'));
|
||||
process.env.ADMIN_CONFIG_DIR = dir;
|
||||
});
|
||||
|
||||
afterEach(async () => {
|
||||
delete process.env.ADMIN_CONFIG_DIR;
|
||||
await rm(dir, { recursive: true, force: true });
|
||||
});
|
||||
|
||||
describe('migratePolicyUnifiedMailbox', () => {
|
||||
it('enables unifiedCrossAccountEnabled when a cross view was active', async () => {
|
||||
await writePolicy({ crossUnreadViewEnabled: true });
|
||||
await migratePolicyUnifiedMailbox();
|
||||
expect((await readFeatures()).unifiedCrossAccountEnabled).toBe(true);
|
||||
expect(existsSync(markerPath())).toBe(true);
|
||||
});
|
||||
|
||||
it('does not enable it for a standalone All-Mail-only policy', async () => {
|
||||
await writePolicy({ allMailViewEnabled: true, crossUnreadViewEnabled: false, crossStarredViewEnabled: false, crossAllViewEnabled: false });
|
||||
await migratePolicyUnifiedMailbox();
|
||||
expect((await readFeatures()).unifiedCrossAccountEnabled).toBeUndefined();
|
||||
});
|
||||
|
||||
it('is a one-shot: a later admin disable survives a re-run', async () => {
|
||||
await writePolicy({ crossAllViewEnabled: true });
|
||||
await migratePolicyUnifiedMailbox();
|
||||
expect((await readFeatures()).unifiedCrossAccountEnabled).toBe(true);
|
||||
|
||||
// Admin turns it back off; the marker is present, so re-running is a no-op.
|
||||
await writePolicy({ crossAllViewEnabled: true, unifiedCrossAccountEnabled: false });
|
||||
await migratePolicyUnifiedMailbox();
|
||||
expect((await readFeatures()).unifiedCrossAccountEnabled).toBe(false);
|
||||
});
|
||||
|
||||
it('no policy.json: writes the marker and does not throw', async () => {
|
||||
await migratePolicyUnifiedMailbox();
|
||||
expect(existsSync(markerPath())).toBe(true);
|
||||
expect(existsSync(policyPath())).toBe(false);
|
||||
});
|
||||
});
|
||||
@@ -33,12 +33,12 @@ class ConfigManager {
|
||||
this.adminConfig = await this.readJsonFile('config.json') || {};
|
||||
const policy = await this.readJsonFile('policy.json');
|
||||
if (policy) {
|
||||
this.policyCache = {
|
||||
this.policyCache = ConfigManager.normalizePolicy({
|
||||
...DEFAULT_POLICY,
|
||||
...policy,
|
||||
features: { ...DEFAULT_FEATURE_GATES, ...(policy.features || {}) },
|
||||
themePolicy: { ...DEFAULT_THEME_POLICY, ...(policy.themePolicy || {}) },
|
||||
};
|
||||
});
|
||||
} else {
|
||||
this.policyCache = { ...DEFAULT_POLICY };
|
||||
}
|
||||
@@ -166,15 +166,28 @@ class ConfigManager {
|
||||
*/
|
||||
async setPolicy(policy: SettingsPolicy): Promise<void> {
|
||||
assertWritable('update settings policy');
|
||||
this.policyCache = {
|
||||
this.policyCache = ConfigManager.normalizePolicy({
|
||||
...DEFAULT_POLICY,
|
||||
...policy,
|
||||
features: { ...DEFAULT_FEATURE_GATES, ...(policy.features || {}) },
|
||||
themePolicy: { ...DEFAULT_THEME_POLICY, ...(policy.themePolicy || {}) },
|
||||
};
|
||||
});
|
||||
await this.writeJsonFile('policy.json', this.policyCache as unknown as Record<string, unknown>);
|
||||
}
|
||||
|
||||
/**
|
||||
* Migrates deprecated feature gates forward. The standalone "All Mail" view
|
||||
* (`allMailViewEnabled`) was folded into the unified "All mail" entry, so an
|
||||
* admin who enabled it keeps that entry available via `crossAllViewEnabled`.
|
||||
* Idempotent - safe to run on every load.
|
||||
*/
|
||||
private static normalizePolicy(policy: SettingsPolicy): SettingsPolicy {
|
||||
if (policy.features.allMailViewEnabled) {
|
||||
policy.features.crossAllViewEnabled = true;
|
||||
}
|
||||
return policy;
|
||||
}
|
||||
|
||||
/**
|
||||
* Reload config from disk (for manual file edits or multi-instance).
|
||||
*/
|
||||
|
||||
@@ -11,6 +11,7 @@ import {
|
||||
import type { AdminConfigData, AdminStateData } from './types';
|
||||
|
||||
const MIGRATION_MARKER = '.migrated-v2';
|
||||
const POLICY_UNIFIED_MARKER = '.migrated-unified-mailbox';
|
||||
|
||||
interface LegacyAdminData {
|
||||
passwordHash: string;
|
||||
@@ -59,6 +60,65 @@ export async function migrateLegacyAdminLayout(): Promise<void> {
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* One-shot policy migration for the Unified Mailbox rework. Before it, the
|
||||
* cross views (crossUnread/crossStarred/crossAll) merged across every logged-in
|
||||
* account, so an admin who had any of them enabled was already permitting
|
||||
* cross-account aggregation. The new `unifiedCrossAccountEnabled` gate (default
|
||||
* false) controls that capability, so enable it whenever a cross view was active
|
||||
* - otherwise existing cross-account installs would silently lose the behaviour
|
||||
* on upgrade (the per-user `unifiedCrossAccount` is AND-ed with this gate).
|
||||
*
|
||||
* Persisted + marker-guarded (not a per-load normalization) so a later admin
|
||||
* decision to disable the gate survives restarts. Skipped on read-only config
|
||||
* dirs - operators who locked their config must migrate manually (mirrors
|
||||
* migrateLegacyAdminLayout). The deprecated `allMailViewEnabled` (a single-account
|
||||
* view, never cross-account) deliberately does NOT trigger this.
|
||||
*/
|
||||
export async function migratePolicyUnifiedMailbox(): Promise<void> {
|
||||
if (isConfigReadOnly()) return;
|
||||
|
||||
const markerPath = getConfigPath(POLICY_UNIFIED_MARKER);
|
||||
if (existsSync(markerPath)) return;
|
||||
|
||||
try {
|
||||
const policyPath = getConfigPath('policy.json');
|
||||
if (existsSync(policyPath)) {
|
||||
let parsed: Record<string, unknown> | null = null;
|
||||
try {
|
||||
parsed = JSON.parse(await readFile(policyPath, 'utf-8')) as Record<string, unknown>;
|
||||
} catch {
|
||||
logger.warn('policy.json is not valid JSON; skipping Unified Mailbox policy migration');
|
||||
}
|
||||
const features =
|
||||
parsed && typeof parsed.features === 'object' && parsed.features
|
||||
? (parsed.features as Record<string, unknown>)
|
||||
: null;
|
||||
if (features) {
|
||||
const hadCrossAccount = !!(
|
||||
features.crossUnreadViewEnabled ||
|
||||
features.crossStarredViewEnabled ||
|
||||
features.crossAllViewEnabled
|
||||
);
|
||||
if (hadCrossAccount && features.unifiedCrossAccountEnabled !== true) {
|
||||
features.unifiedCrossAccountEnabled = true;
|
||||
const tmp = policyPath + '.tmp';
|
||||
await writeFile(tmp, JSON.stringify(parsed, null, 2), 'utf-8');
|
||||
await rename(tmp, policyPath);
|
||||
logger.info('Migrated policy: enabled unifiedCrossAccountEnabled (cross-account views were active)');
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
await ensureConfigDir();
|
||||
await writeFile(markerPath, new Date().toISOString(), 'utf-8');
|
||||
} catch (error) {
|
||||
logger.warn('Unified Mailbox policy migration failed; will retry on next boot', {
|
||||
error: error instanceof Error ? error.message : 'Unknown error',
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* If the existing admin.json carries timestamp fields (legacy mixed layout),
|
||||
* split them into admin-state.json and rewrite admin.json without them.
|
||||
|
||||
@@ -60,10 +60,12 @@ export interface FeatureGates {
|
||||
hoverActionsConfigEnabled: boolean;
|
||||
filesEnabled: boolean;
|
||||
contactsEnabled: boolean;
|
||||
/** @deprecated Folded into `crossAllViewEnabled`; normalized forward on policy load. */
|
||||
allMailViewEnabled: boolean;
|
||||
crossUnreadViewEnabled: boolean;
|
||||
crossStarredViewEnabled: boolean;
|
||||
crossAllViewEnabled: boolean;
|
||||
unifiedCrossAccountEnabled: boolean;
|
||||
}
|
||||
|
||||
export const DEFAULT_FEATURE_GATES: FeatureGates = {
|
||||
@@ -89,6 +91,7 @@ export const DEFAULT_FEATURE_GATES: FeatureGates = {
|
||||
crossUnreadViewEnabled: false,
|
||||
crossStarredViewEnabled: false,
|
||||
crossAllViewEnabled: false,
|
||||
unifiedCrossAccountEnabled: false,
|
||||
};
|
||||
|
||||
export interface ThemePolicy {
|
||||
|
||||
Reference in New Issue
Block a user