SRCmail/ROADMAP.md

JMAP Webmail - Roadmap

This document tracks the development status and planned features for JMAP Webmail.

Completed Features

Core Infrastructure

• Next.js 16 with TypeScript and App Router
• Tailwind CSS v4 with Oxide engine
• Zustand state management
• JMAP client implementation (jmap-jam)

Authentication

• Login with JMAP server authentication
• Session management (no password storage for security)
• Username autocomplete with history
• Logout functionality
• Authentication error handling
• JMAP identities for sender address
• TOTP two-factor authentication (Stalwart-compatible)

JMAP Server Connection

• Session establishment and keep-alive
• Connection error handling and retries
• Storage quota display
• Server capability detection
• Shared folders support (multi-account access)

Email Operations

• Email fetching and display
• Full HTML email rendering
• Compose, reply, reply-all, forward
• Draft auto-save with discard confirmation
• Mark as read/unread
• Star/unstar emails
• Delete and archive
• Color tags/labels
• Full-text search
• Advanced search with JMAP filter panel, search chips, and cross-mailbox queries
• Attachment upload and download
• Batch operations (multi-select)
• Quick reply form
• Email threading (Gmail-style inline expansion)

Real-time Updates

• EventSource for JMAP push notifications
• State synchronization
• Email arrival notifications
• Real-time unread counts
• Mailbox change handling

User Interface

• Three-pane layout (sidebar, list, viewer)
• Minimalist design system
• Dark and light theme support
• Custom scrollbars
• Mobile responsive design
• Keyboard shortcuts
• Drag-and-drop email organization
• Right-click context menus
• Hierarchical mailbox display
• Email list with avatars and visual hierarchy
• Expandable email headers
• External content warning banner
• SPF/DKIM/DMARC status indicators
• Loading states and skeletons
• Smooth transitions and animations
• Infinite scroll pagination
• Virtual scrolling for large email lists
• Error boundaries
• Settings page with preferences
• Navigation rail (desktop vertical icon sidebar + mobile bottom tab bar)
• Welcome banner for first-time users (one-time display, localStorage persistence)
• Confirmation dialog component with promise-based useConfirmDialog hook
• Toast notifications with undo action support and typed durations
• Inline form validation with shake animation (email composer, contact form)
• Login UX polish (error shake, TOTP slide animation, password visibility toggle, session expired banner)
• Empty state patterns for contacts (distinct "no data" vs "no search results" with contextual actions)
• WCAG AA reduced-motion media query (global animation/transition reset)
• Safe area inset utilities for notched devices
• Screen reader live region announcements (sr-only)

Internationalization

• English language support
• French language support
• Japanese language support
• Spanish language support
• Italian language support
• German language support
• Dutch language support
• Portuguese language support
• Automatic browser language detection
• Language preference persistence

Security & Accessibility

• External content blocked by default
• HTML sanitization with DOMPurify
• User control for loading external content
• Trusted senders list for automatic image loading
• Dark mode email readability (intelligent color transformation)
• WCAG 2.0 Level AA color contrast compliance
• Newsletter unsubscribe support (RFC 2369)
• XSS attack prevention with comprehensive validation
• CSP Report-Only headers with per-request nonce
• Security headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy)
• Reusable focus trap hook (Tab cycling, Escape handling, focus restore)
• WCAG AA prefers-reduced-motion support (global animation/transition reset)
• Safe area insets for notched mobile devices
• Screen reader sr-only live region for dynamic announcements

Identity Management

• Multiple sender identities (name, email, signature)
• Sub-addressing support (user+tag@domain.com)
• Per-identity signatures
• Identity badges in email viewer and list
• Tag suggestions based on context

Address Book & Contacts

• Contact store with JMAP sync and local fallback
• Contact CRUD operations (create, read, update, delete)
• Contacts list view with search/filter
• Contact details view/edit form
• JMAP contacts sync (RFC 9553/9610 ContactCard/AddressBook)
• Email autocomplete from contacts
• Contacts integration in email composer (To/Cc/Bcc)
• Contact groups/lists management with JMAP members map
• vCard import/export (RFC 6350 parser/generator, duplicate detection)
• Bulk contact operations (multi-select, delete, group add, export)
• i18n support for contacts (all 8 languages)

Vacation Responder

• JMAP VacationResponse singleton management
• Settings tab with date range and message configuration
• Sidebar indicator when vacation auto-reply is active
• i18n support (all 8 languages)

Calendar Integration

• JMAP Calendar types (RFC 8984) and client methods
• Calendar capability detection (urn:ietf:params:jmap:calendars)
• Calendar store with Zustand (persist middleware)
• Month, week, day, and agenda views
• Event modal (create/edit/delete with recurrence, reminders)
• Mini-calendar sidebar with calendar visibility toggles
• Calendar settings (default view, week start, time format)
• Multi-day event spanning across all covered days
• Column-based overlap layout for concurrent events
• Locale-aware date formatting via next-intl
• First day of week and time format settings wired to views
• Push notification handling for calendar state changes
• Calendar page capability check (redirect if unsupported)
• Error handling with toast feedback on event CRUD
• Timezone auto-detection on event creation
• Input validation, color sanitization, focus trap
• ARIA grid roles and event card accessible labels
• Mobile touch targets (44px minimum)
• Calendar keyboard shortcuts (m/w/d/a views, t today, n new event)
• i18n support with ICU pluralization (all 8 languages)
• Drag-and-drop event rescheduling (week/day time snap, month date move)
• iCalendar (.ics) file import via CalendarEvent/parse with preview and bulk create
• Event notifications with client-side alert evaluation and toast display
• Notification sound, acknowledged alert persistence (localStorage), proactive 24h event fetch
• Configurable notification settings (enable/disable, sound toggle)
• Participant scheduling with iTIP invitations (organizer/attendee UI, RSVP buttons, contact autocomplete)
• Inline calendar invitation banner in email viewer (auto-detect .ics attachments, RSVP, import to calendar, cancellation display)
• Scheduling message support (sendSchedulingMessages flag for create/update/delete)
• Click-drag to create events (pointer-based time range selection, 15-min snap, visual overlay)
• Event resize by dragging bottom edge handle (15-min snap, optimistic JMAP update)
• Recurring event edit/delete scope dialog (this event / this and following / all events)
• Double-click quick event creation (inline title input, PT1H default)
• Event duplication button in modal (clones event +1 day, opens for editing)

Email Filters

• JMAP Sieve Scripts (RFC 9661) with capability detection
• Visual rule builder (conditions: From/To/Cc/Subject/Header/Size/Body, actions: Move/Copy/Forward/Mark read/Star/Label/Discard/Reject/Keep/Stop)
• Raw Sieve script editor with syntax validation
• Sieve generator and parser with JSON metadata round-trip
• Filter store with CRUD, reorder, toggle, auto-save with rollback
• Opaque script detection with reset to visual builder option
• Focus trap accessibility in modals
• Toast validation feedback for empty rules
• Push notification handling for SieveScript state changes
• i18n support (all 8 languages)

Email Templates

• Reusable email templates with local storage persistence
• Category organization (General, Business, Personal, Support, Follow-up, custom)
• Dynamic placeholder variables with auto-fill from composer context
• Template manager modal (create, edit, duplicate, delete)
• Template picker in composer toolbar with search and category filter
• Custom placeholder prompt on template insertion
• Settings tab for template management
• Keyboard shortcut (Ctrl+Shift+T to insert template)
• i18n support (all 8 languages)

Email Display

• Proper email layout without horizontal scroll or clipping
• Blocked image container collapsing (no empty spaces in newsletters)

Testing

• Unit tests for validation utilities (57 tests)
• Unit tests for email sanitization (27 tests)
• Unit tests for color transformation (40 tests)
• Unit tests for contact store (56 tests)
• Unit tests for JMAP contact client (41 tests)
• Unit tests for vCard parser (18 tests)
• Unit tests for thread utilities (20 tests)
• Unit tests for email headers (39 tests)
• Component tests (contacts, UI components — 41 tests)
• JMAP client method tests (identity: 20, contacts: 41)
• Unit tests for Sieve generator (50 tests)
• Unit tests for Sieve parser (14 tests)
• Unit tests for calendar alerts (36 tests)
• Unit tests for calendar notification store (8 tests)
• Unit tests for calendar invitation parsing (25 tests)
• Unit tests for calendar participants (26 tests)
• Unit tests for template utilities (48 tests)
• XSS attack vector testing
• Playwright E2E framework setup

Deployment

• Runtime environment variables (Docker-friendly configuration)
• Health check endpoint
• Docker support (multi-stage build, docker-compose, standalone output)
• Structured server-side logger (text/JSON format, configurable level)
• Pre-built Docker image on GitHub Container Registry (ghcr.io) with multi-arch support (amd64/arm64)
• GitHub Actions CI/CD for automated image publishing on releases

Planned Features

Advanced Features

• Free/busy queries (Principal/getAvailability)
• Calendar sharing UI (JMAP Sharing RFC 9670)
• Email encryption (PGP/GPG)
• OAuth2/OIDC authentication (opt-in, Basic Auth remains default)

Performance Optimizations

• Email content caching
• Bundle size optimization
• Service worker for offline support
• Lazy loading for attachments

Testing (Remaining)

• E2E tests with real JMAP server
• Accessibility testing
• Performance testing

Deployment

• Production build optimizations
• Monitoring and logging

Security Enhancements

• Rate limiting
• CORS configuration

Known Issues

• Next.js workspace root warning (cosmetic)

Contributing

Want to help implement a feature? Check out our CONTRIBUTING.md guide!