SRCmail/ROADMAP.md

JMAP Webmail - Roadmap

This document tracks the development status and planned features for JMAP Webmail.

Completed Features

Core Infrastructure

• Next.js 16 with TypeScript and App Router
• Tailwind CSS v4 with Oxide engine
• Zustand state management
• JMAP client implementation (jmap-jam)

Authentication

• Login with JMAP server authentication
• Session management (no password storage for security)
• Username autocomplete with history
• Logout functionality
• Authentication error handling
• JMAP identities for sender address

JMAP Server Connection

• Session establishment and keep-alive
• Connection error handling and retries
• Storage quota display
• Server capability detection
• Shared folders support (multi-account access)

Email Operations

• Email fetching and display
• Full HTML email rendering
• Compose, reply, reply-all, forward
• Draft auto-save with discard confirmation
• Mark as read/unread
• Star/unstar emails
• Delete and archive
• Color tags/labels
• Full-text search
• Attachment upload and download
• Batch operations (multi-select)
• Quick reply form
• Email threading (Gmail-style inline expansion)

Real-time Updates

• EventSource for JMAP push notifications
• State synchronization
• Email arrival notifications
• Real-time unread counts
• Mailbox change handling

User Interface

• Three-pane layout (sidebar, list, viewer)
• Minimalist design system
• Dark and light theme support
• Custom scrollbars
• Mobile responsive design
• Keyboard shortcuts
• Drag-and-drop email organization
• Right-click context menus
• Hierarchical mailbox display
• Email list with avatars and visual hierarchy
• Expandable email headers
• External content warning banner
• SPF/DKIM/DMARC status indicators
• Loading states and skeletons
• Smooth transitions and animations
• Infinite scroll pagination
• Error boundaries
• Settings page with preferences

Internationalization

• English language support
• French language support
• Japanese language support
• Spanish language support
• Italian language support
• German language support
• Dutch language support
• Portuguese language support
• Automatic browser language detection
• Language preference persistence

Security & Accessibility

• External content blocked by default
• HTML sanitization with DOMPurify
• User control for loading external content
• Trusted senders list for automatic image loading
• Dark mode email readability (intelligent color transformation)
• WCAG 2.0 Level AA color contrast compliance
• Newsletter unsubscribe support (RFC 2369)
• XSS attack prevention with comprehensive validation

Identity Management

• Multiple sender identities (name, email, signature)
• Sub-addressing support (user+tag@domain.com)
• Per-identity signatures
• Identity badges in email viewer and list
• Tag suggestions based on context

Testing

• Unit tests for validation utilities (57 tests)
• Unit tests for email sanitization
• Unit tests for color transformation
• XSS attack vector testing

Deployment

• Runtime environment variables (Docker-friendly configuration)

Planned Features

Address Book & Contacts

• Contact store with CRUD operations
• Contacts list view with search/filter
• Contact details view/edit form
• Contact groups management
• vCard import/export
• JMAP contacts sync (if server supports)
• Email autocomplete from contacts
• Contacts integration in composer

Advanced Features

• Email filters and rules
• Calendar integration (JMAP Calendars)
• Email templates
• Vacation responder settings
• Advanced search with filters
• Email encryption (PGP/GPG)

Performance Optimizations

• Virtual scrolling for large lists
• Email content caching
• Bundle size optimization
• Service worker for offline support
• Lazy loading for attachments

Testing (Remaining)

• Component tests
• E2E tests with Playwright
• Accessibility testing
• Performance testing

Deployment

• Health check endpoint
• Docker containerization
• Production build optimizations
• Monitoring and logging

Security Enhancements

• CSP headers configuration
• Additional XSS protection layers
• Rate limiting
• CORS configuration

Known Issues

• Next.js workspace root warning (cosmetic)

Contributing

Want to help implement a feature? Check out our CONTRIBUTING.md guide!