feat: add Stalwart account security management

- Add Stalwart API client library (lib/stalwart/client.ts) - Add server-side proxy routes for auth, crypto, password, principal, probe - Add account security Zustand store with full state management - Add Security settings tab with password change, display name, TOTP 2FA, app passwords, and encryption-at-rest controls - Add stalwartFeaturesEnabled config flag (opt-out via STALWART_FEATURES=false) - Add i18n translations for all 8 locales (en, de, es, fr, it, ja, nl, pt) - Add tests for Stalwart client (24 tests) and security store (29 tests)
2026-03-12 02:20:56 +01:00
parent 68d4a9a641
commit ab72fc06ff
26 changed files with 3143 additions and 310 deletions
@@ -0,0 +1,100 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { cookies } from 'next/headers';
+import { logger } from '@/lib/logger';
+import { decryptSession } from '@/lib/auth/crypto';
+import { SESSION_COOKIE } from '@/lib/auth/session-cookie';
+
+/**
+ * Extract the user's JMAP server URL and auth header from the session cookie
+ * or from the Authorization header passed by the client.
+ */
+async function getCredentials(request: NextRequest): Promise<{ serverUrl: string; authHeader: string; username: string } | null> {
+  // Try Authorization header first (for bearer/basic auth forwarding)
+  const authHeader = request.headers.get('Authorization');
+  const serverUrl = request.headers.get('X-JMAP-Server-URL');
+  const username = request.headers.get('X-JMAP-Username');
+
+  if (authHeader && serverUrl && username) {
+    return { serverUrl, authHeader, username };
+  }
+
+  // Fall back to session cookie
+  const cookieStore = await cookies();
+  const token = cookieStore.get(SESSION_COOKIE)?.value;
+  if (!token) return null;
+
+  const credentials = decryptSession(token);
+  if (!credentials) return null;
+
+  const basic = `Basic ${Buffer.from(`${credentials.username}:${credentials.password}`).toString('base64')}`;
+  return { serverUrl: credentials.serverUrl, authHeader: basic, username: credentials.username };
+}
+
+/**
+ * GET /api/account/stalwart/auth
+ * Proxy to Stalwart GET /api/account/auth
+ */
+export async function GET(request: NextRequest) {
+  try {
+    const creds = await getCredentials(request);
+    if (!creds) {
+      return NextResponse.json({ error: 'Not authenticated' }, { status: 401 });
+    }
+
+    const response = await fetch(`${creds.serverUrl}/api/account/auth`, {
+      method: 'GET',
+      headers: { 'Authorization': creds.authHeader },
+    });
+
+    if (!response.ok) {
+      const text = await response.text();
+      logger.warn('Stalwart auth info failed', { status: response.status });
+      return NextResponse.json(
+        { error: 'Failed to fetch auth info', details: text },
+        { status: response.status }
+      );
+    }
+
+    const data = await response.json();
+    return NextResponse.json(data);
+  } catch (error) {
+    logger.error('Stalwart auth proxy error', { error: error instanceof Error ? error.message : 'Unknown' });
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
+  }
+}
+
+/**
+ * POST /api/account/stalwart/auth
+ * Proxy to Stalwart POST /api/account/auth
+ */
+export async function POST(request: NextRequest) {
+  try {
+    const creds = await getCredentials(request);
+    if (!creds) {
+      return NextResponse.json({ error: 'Not authenticated' }, { status: 401 });
+    }
+
+    const body = await request.json();
+
+    const response = await fetch(`${creds.serverUrl}/api/account/auth`, {
+      method: 'POST',
+      headers: {
+        'Authorization': creds.authHeader,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify(body),
+    });
+
+    const data = await response.json();
+
+    if (!response.ok) {
+      logger.warn('Stalwart auth update failed', { status: response.status });
+      return NextResponse.json(data, { status: response.status });
+    }
+
+    return NextResponse.json(data);
+  } catch (error) {
+    logger.error('Stalwart auth update proxy error', { error: error instanceof Error ? error.message : 'Unknown' });
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
+  }
+}
@@ -0,0 +1,94 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { cookies } from 'next/headers';
+import { logger } from '@/lib/logger';
+import { decryptSession } from '@/lib/auth/crypto';
+import { SESSION_COOKIE } from '@/lib/auth/session-cookie';
+
+async function getCredentials(request: NextRequest): Promise<{ serverUrl: string; authHeader: string; username: string } | null> {
+  const authHeader = request.headers.get('Authorization');
+  const serverUrl = request.headers.get('X-JMAP-Server-URL');
+  const username = request.headers.get('X-JMAP-Username');
+
+  if (authHeader && serverUrl && username) {
+    return { serverUrl, authHeader, username };
+  }
+
+  const cookieStore = await cookies();
+  const token = cookieStore.get(SESSION_COOKIE)?.value;
+  if (!token) return null;
+
+  const credentials = decryptSession(token);
+  if (!credentials) return null;
+
+  const basic = `Basic ${Buffer.from(`${credentials.username}:${credentials.password}`).toString('base64')}`;
+  return { serverUrl: credentials.serverUrl, authHeader: basic, username: credentials.username };
+}
+
+/**
+ * GET /api/account/stalwart/crypto
+ * Proxy to Stalwart GET /api/account/crypto
+ */
+export async function GET(request: NextRequest) {
+  try {
+    const creds = await getCredentials(request);
+    if (!creds) {
+      return NextResponse.json({ error: 'Not authenticated' }, { status: 401 });
+    }
+
+    const response = await fetch(`${creds.serverUrl}/api/account/crypto`, {
+      method: 'GET',
+      headers: { 'Authorization': creds.authHeader },
+    });
+
+    if (!response.ok) {
+      const text = await response.text();
+      logger.warn('Stalwart crypto info failed', { status: response.status });
+      return NextResponse.json(
+        { error: 'Failed to fetch crypto info', details: text },
+        { status: response.status }
+      );
+    }
+
+    const data = await response.json();
+    return NextResponse.json(data);
+  } catch (error) {
+    logger.error('Stalwart crypto proxy error', { error: error instanceof Error ? error.message : 'Unknown' });
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
+  }
+}
+
+/**
+ * POST /api/account/stalwart/crypto
+ * Proxy to Stalwart POST /api/account/crypto
+ */
+export async function POST(request: NextRequest) {
+  try {
+    const creds = await getCredentials(request);
+    if (!creds) {
+      return NextResponse.json({ error: 'Not authenticated' }, { status: 401 });
+    }
+
+    const body = await request.json();
+
+    const response = await fetch(`${creds.serverUrl}/api/account/crypto`, {
+      method: 'POST',
+      headers: {
+        'Authorization': creds.authHeader,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify(body),
+    });
+
+    const data = await response.json();
+
+    if (!response.ok) {
+      logger.warn('Stalwart crypto update failed', { status: response.status });
+      return NextResponse.json(data, { status: response.status });
+    }
+
+    return NextResponse.json(data);
+  } catch (error) {
+    logger.error('Stalwart crypto update proxy error', { error: error instanceof Error ? error.message : 'Unknown' });
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
+  }
+}
@@ -0,0 +1,104 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { cookies } from 'next/headers';
+import { logger } from '@/lib/logger';
+import { decryptSession, encryptSession } from '@/lib/auth/crypto';
+import { SESSION_COOKIE, SESSION_COOKIE_MAX_AGE } from '@/lib/auth/session-cookie';
+
+const COOKIE_OPTIONS = {
+  httpOnly: true,
+  secure: process.env.NODE_ENV === 'production',
+  sameSite: 'lax' as const,
+  path: '/',
+  maxAge: SESSION_COOKIE_MAX_AGE,
+};
+
+async function getCredentials(request: NextRequest): Promise<{ serverUrl: string; authHeader: string; username: string; hasSessionCookie: boolean } | null> {
+  const authHeader = request.headers.get('Authorization');
+  const serverUrl = request.headers.get('X-JMAP-Server-URL');
+  const username = request.headers.get('X-JMAP-Username');
+
+  if (authHeader && serverUrl && username) {
+    const cookieStore = await cookies();
+    const hasSessionCookie = !!cookieStore.get(SESSION_COOKIE)?.value;
+    return { serverUrl, authHeader, username, hasSessionCookie };
+  }
+
+  const cookieStore = await cookies();
+  const token = cookieStore.get(SESSION_COOKIE)?.value;
+  if (!token) return null;
+
+  const credentials = decryptSession(token);
+  if (!credentials) return null;
+
+  const basic = `Basic ${Buffer.from(`${credentials.username}:${credentials.password}`).toString('base64')}`;
+  return { serverUrl: credentials.serverUrl, authHeader: basic, username: credentials.username, hasSessionCookie: true };
+}
+
+/**
+ * POST /api/account/stalwart/password
+ * Change user password via Stalwart PATCH /api/principal/{name}
+ *
+ * Body: { currentPassword: string, newPassword: string }
+ */
+export async function POST(request: NextRequest) {
+  try {
+    const creds = await getCredentials(request);
+    if (!creds) {
+      return NextResponse.json({ error: 'Not authenticated' }, { status: 401 });
+    }
+
+    const { currentPassword, newPassword } = await request.json();
+
+    if (!currentPassword || !newPassword) {
+      return NextResponse.json({ error: 'Missing required fields' }, { status: 400 });
+    }
+
+    if (newPassword.length < 8) {
+      return NextResponse.json({ error: 'Password must be at least 8 characters' }, { status: 400 });
+    }
+
+    // Verify current password by attempting to authenticate
+    const verifyAuth = `Basic ${Buffer.from(`${creds.username}:${currentPassword}`).toString('base64')}`;
+    const verifyResponse = await fetch(`${creds.serverUrl}/.well-known/jmap`, {
+      method: 'GET',
+      headers: { 'Authorization': verifyAuth },
+    });
+
+    if (!verifyResponse.ok) {
+      return NextResponse.json({ error: 'Current password is incorrect' }, { status: 403 });
+    }
+
+    // Change password via Stalwart principal API
+    const response = await fetch(`${creds.serverUrl}/api/principal/${encodeURIComponent(creds.username)}`, {
+      method: 'PATCH',
+      headers: {
+        'Authorization': creds.authHeader,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify([
+        { action: 'set', field: 'secrets', value: newPassword },
+      ]),
+    });
+
+    if (!response.ok) {
+      const text = await response.text();
+      logger.warn('Stalwart password change failed', { status: response.status });
+      return NextResponse.json(
+        { error: 'Failed to change password', details: text },
+        { status: response.status }
+      );
+    }
+
+    // If session cookie exists, update it with the new password
+    if (creds.hasSessionCookie) {
+      const newToken = encryptSession(creds.serverUrl, creds.username, newPassword);
+      const cookieStore = await cookies();
+      cookieStore.set(SESSION_COOKIE, newToken, COOKIE_OPTIONS);
+    }
+
+    return NextResponse.json({ ok: true });
+  } catch (error) {
+    logger.error('Stalwart password change proxy error', { error: error instanceof Error ? error.message : 'Unknown' });
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
+  }
+}
@@ -0,0 +1,103 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { cookies } from 'next/headers';
+import { logger } from '@/lib/logger';
+import { decryptSession } from '@/lib/auth/crypto';
+import { SESSION_COOKIE } from '@/lib/auth/session-cookie';
+
+async function getCredentials(request: NextRequest): Promise<{ serverUrl: string; authHeader: string; username: string } | null> {
+  const authHeader = request.headers.get('Authorization');
+  const serverUrl = request.headers.get('X-JMAP-Server-URL');
+  const username = request.headers.get('X-JMAP-Username');
+
+  if (authHeader && serverUrl && username) {
+    return { serverUrl, authHeader, username };
+  }
+
+  const cookieStore = await cookies();
+  const token = cookieStore.get(SESSION_COOKIE)?.value;
+  if (!token) return null;
+
+  const credentials = decryptSession(token);
+  if (!credentials) return null;
+
+  const basic = `Basic ${Buffer.from(`${credentials.username}:${credentials.password}`).toString('base64')}`;
+  return { serverUrl: credentials.serverUrl, authHeader: basic, username: credentials.username };
+}
+
+/**
+ * GET /api/account/stalwart/principal
+ * Proxy to Stalwart GET /api/principal/{username}
+ */
+export async function GET(request: NextRequest) {
+  try {
+    const creds = await getCredentials(request);
+    if (!creds) {
+      return NextResponse.json({ error: 'Not authenticated' }, { status: 401 });
+    }
+
+    const response = await fetch(`${creds.serverUrl}/api/principal/${encodeURIComponent(creds.username)}`, {
+      method: 'GET',
+      headers: { 'Authorization': creds.authHeader },
+    });
+
+    if (!response.ok) {
+      const text = await response.text();
+      logger.warn('Stalwart principal fetch failed', { status: response.status });
+      return NextResponse.json(
+        { error: 'Failed to fetch principal', details: text },
+        { status: response.status }
+      );
+    }
+
+    const data = await response.json();
+    return NextResponse.json(data);
+  } catch (error) {
+    logger.error('Stalwart principal proxy error', { error: error instanceof Error ? error.message : 'Unknown' });
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
+  }
+}
+
+/**
+ * PATCH /api/account/stalwart/principal
+ * Proxy to Stalwart PATCH /api/principal/{username}
+ * Body: PrincipalUpdateAction[] (array of {action, field, value})
+ */
+export async function PATCH(request: NextRequest) {
+  try {
+    const creds = await getCredentials(request);
+    if (!creds) {
+      return NextResponse.json({ error: 'Not authenticated' }, { status: 401 });
+    }
+
+    const body = await request.json();
+
+    // Prevent secrets field from being changed through this endpoint (use /password instead)
+    if (Array.isArray(body)) {
+      const hasSecrets = body.some((action: { field?: string }) => action.field === 'secrets');
+      if (hasSecrets) {
+        return NextResponse.json({ error: 'Use /api/account/stalwart/password to change passwords' }, { status: 400 });
+      }
+    }
+
+    const response = await fetch(`${creds.serverUrl}/api/principal/${encodeURIComponent(creds.username)}`, {
+      method: 'PATCH',
+      headers: {
+        'Authorization': creds.authHeader,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify(body),
+    });
+
+    const data = await response.json();
+
+    if (!response.ok) {
+      logger.warn('Stalwart principal update failed', { status: response.status });
+      return NextResponse.json(data, { status: response.status });
+    }
+
+    return NextResponse.json(data);
+  } catch (error) {
+    logger.error('Stalwart principal update proxy error', { error: error instanceof Error ? error.message : 'Unknown' });
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
+  }
+}
@@ -0,0 +1,65 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { cookies } from 'next/headers';
+import { logger } from '@/lib/logger';
+import { decryptSession } from '@/lib/auth/crypto';
+import { SESSION_COOKIE } from '@/lib/auth/session-cookie';
+
+async function getCredentials(request: NextRequest): Promise<{ serverUrl: string; authHeader: string } | null> {
+  const authHeader = request.headers.get('Authorization');
+  const serverUrl = request.headers.get('X-JMAP-Server-URL');
+
+  if (authHeader && serverUrl) {
+    return { serverUrl, authHeader };
+  }
+
+  const cookieStore = await cookies();
+  const token = cookieStore.get(SESSION_COOKIE)?.value;
+  if (!token) return null;
+
+  const credentials = decryptSession(token);
+  if (!credentials) return null;
+
+  const basic = `Basic ${Buffer.from(`${credentials.username}:${credentials.password}`).toString('base64')}`;
+  return { serverUrl: credentials.serverUrl, authHeader: basic };
+}
+
+/**
+ * GET /api/account/stalwart/probe
+ * Detect whether the JMAP server is Stalwart by probing /api/account/auth
+ */
+export async function GET(request: NextRequest) {
+  try {
+    const creds = await getCredentials(request);
+    if (!creds) {
+      return NextResponse.json({ isStalwart: false });
+    }
+
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 5000);
+
+    try {
+      const response = await fetch(`${creds.serverUrl}/api/account/auth`, {
+        method: 'GET',
+        headers: { 'Authorization': creds.authHeader },
+        signal: controller.signal,
+      });
+
+      clearTimeout(timeout);
+
+      if (!response.ok) {
+        return NextResponse.json({ isStalwart: false });
+      }
+
+      const data = await response.json();
+      const isStalwart = data.data !== undefined && typeof data.data.otpEnabled === 'boolean';
+
+      return NextResponse.json({ isStalwart });
+    } catch {
+      clearTimeout(timeout);
+      return NextResponse.json({ isStalwart: false });
+    }
+  } catch (error) {
+    logger.error('Stalwart probe error', { error: error instanceof Error ? error.message : 'Unknown' });
+    return NextResponse.json({ isStalwart: false });
+  }
+}
@@ -23,6 +23,7 @@ export async function GET() {
    oauthIssuerUrl: process.env.OAUTH_ISSUER_URL || '',
    rememberMeEnabled: !!process.env.SESSION_SECRET,
    settingsSyncEnabled: process.env.SETTINGS_SYNC_ENABLED === 'true' && !!process.env.SESSION_SECRET,
+    stalwartFeaturesEnabled: process.env.STALWART_FEATURES !== 'false',
    devMode: process.env.DEV_MOCK_JMAP === 'true',
  });
 }