Bernd Rodler
cfdd091d22
feat: Phase 3+4 — security hardening + polish + offline + Electron push
...
Phase 3 (security):
- P3.1: Feature gate server-side enforcement (403 on disabled features)
- P3.2: Unified auth error interceptor (401→logout)
- P3.3: Store-level state isolation via StoreSnapshot contract
(added message-list-tabs + task stores to snapshot/restore cycle)
- P3.4: Push event bus extraction — email-store no longer imports
calendar/contact/filter/file stores directly
- P1.3: Auth localStorage AES-GCM encryption via custom Zustand adapter
Phase 4 (polish):
- P4.1: Offline write queue — pending operations in localStorage,
auto-retry on reconnect, offline-queue-indicator banner
- P4.2: Identity spoofing — fromOverrideEmail domain validation
- P4.3: WebSocket push for Electron via main-process IPC bridge
(ws package with Authorization headers)
2026-08-07 22:10:26 +02:00
Linus Rath
964136b540
feat: require re-authentication for device pairing and SSO
2026-06-05 19:23:06 +02:00
Linus Rath
1d050f8469
feat: add QR code device pairing for mobile app login
2026-06-05 17:41:55 +02:00
Pascal Dietrich and Linus Rath
b508551d02
feat: add sessionSecretFile and oauthClientSecretFile for JSON config
2026-05-31 00:14:38 +02:00
Linus Rath
f275fbe2e4
fix: bind stalwart auth context to credential, not cookie-claimed username
2026-05-18 13:00:40 +02:00
Linus Rath
51745ea03d
feat: web setup wizard + admin config/state dir split ( #226 )
2026-05-09 17:37:41 +02:00
Linus Rath
5f464d4ee2
feat: lift 5-account cap on HTTP/2
2026-05-07 12:28:33 +02:00
Linus Rath
45a4db1c22
fix: pin JMAP auth verification to configured server URL #237
2026-04-30 15:34:14 +02:00
Linus Rath
3043639d2d
fix: validate URLs before outbound fetch
2026-04-27 22:23:39 +02:00
Pascal Dietrich and Linus Rath
f9052eb23f
feat: add SESSION_SECRET_FILE and OAUTH_CLIENT_SECRET_FILE env vars
2026-04-09 22:13:08 +02:00
Linus Rath
aa40c8be26
fix: harden proxy auth and SSRF defenses
2026-03-31 17:47:09 +02:00
Linus Rath
66fe7fd359
fix: enhance security by blocking plugins with dangerous JS patterns and enforcing strict session secret length
2026-03-31 15:56:32 +02:00
Linus Rath
83a0a1e235
feat: add non-interactive SSO login flow for embedded/iframe deployments ( closes #69 )
2026-03-21 20:45:19 +01:00
Linus Rath
d493bb17dc
feat: implement account switcher component and state management
...
- Add AccountSwitcher component for managing user accounts with UI for switching, adding, and logging out.
- Create account state manager to handle snapshots of account-specific states for efficient switching.
- Introduce utility functions for account management, including ID generation and avatar color assignment.
- Implement Zustand store for account management, supporting addition, removal, and state retrieval of accounts.
2026-03-19 10:08:57 +01:00
Matthieu MALVACHE and Matthieu MALVACHE
1b0e3e41c6
feat: add "Remember me" session persistence and simplify 2FA UX
2026-02-26 00:47:53 +01:00
Bernd Rodler