SRCmail/ROADMAP.md

JMAP Webmail - Roadmap

This document tracks the development status and planned features for JMAP Webmail.

Completed Features

Core Infrastructure

• Next.js 16 with TypeScript and App Router
• Tailwind CSS v4 with Oxide engine
• Zustand state management
• JMAP client implementation (jmap-jam)

Authentication

• Login with JMAP server authentication
• Session management (no password storage for security)
• Username autocomplete with history
• Logout functionality
• Authentication error handling
• JMAP identities for sender address
• TOTP two-factor authentication (Stalwart-compatible)

JMAP Server Connection

• Session establishment and keep-alive
• Connection error handling and retries
• Storage quota display
• Server capability detection
• Shared folders support (multi-account access)

Email Operations

• Email fetching and display
• Full HTML email rendering
• Compose, reply, reply-all, forward
• Draft auto-save with discard confirmation
• Mark as read/unread
• Star/unstar emails
• Delete and archive
• Color tags/labels
• Full-text search
• Advanced search with JMAP filter panel, search chips, and cross-mailbox queries
• Attachment upload and download
• Batch operations (multi-select)
• Quick reply form
• Email threading (Gmail-style inline expansion)

Real-time Updates

• EventSource for JMAP push notifications
• State synchronization
• Email arrival notifications
• Real-time unread counts
• Mailbox change handling

User Interface

• Three-pane layout (sidebar, list, viewer)
• Minimalist design system
• Dark and light theme support
• Custom scrollbars
• Mobile responsive design
• Keyboard shortcuts
• Drag-and-drop email organization
• Right-click context menus
• Hierarchical mailbox display
• Email list with avatars and visual hierarchy
• Expandable email headers
• External content warning banner
• SPF/DKIM/DMARC status indicators
• Loading states and skeletons
• Smooth transitions and animations
• Infinite scroll pagination
• Virtual scrolling for large email lists
• Error boundaries
• Settings page with preferences

Internationalization

• English language support
• French language support
• Japanese language support
• Spanish language support
• Italian language support
• German language support
• Dutch language support
• Portuguese language support
• Automatic browser language detection
• Language preference persistence

Security & Accessibility

• External content blocked by default
• HTML sanitization with DOMPurify
• User control for loading external content
• Trusted senders list for automatic image loading
• Dark mode email readability (intelligent color transformation)
• WCAG 2.0 Level AA color contrast compliance
• Newsletter unsubscribe support (RFC 2369)
• XSS attack prevention with comprehensive validation
• CSP Report-Only headers with per-request nonce
• Security headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy)

Identity Management

• Multiple sender identities (name, email, signature)
• Sub-addressing support (user+tag@domain.com)
• Per-identity signatures
• Identity badges in email viewer and list
• Tag suggestions based on context

Address Book & Contacts

• Contact store with JMAP sync and local fallback
• Contact CRUD operations (create, read, update, delete)
• Contacts list view with search/filter
• Contact details view/edit form
• JMAP contacts sync (RFC 9553/9610 ContactCard/AddressBook)
• Email autocomplete from contacts
• Contacts integration in email composer (To/Cc/Bcc)
• Contact groups/lists management with JMAP members map
• vCard import/export (RFC 6350 parser/generator, duplicate detection)
• Bulk contact operations (multi-select, delete, group add, export)
• i18n support for contacts (all 8 languages)

Vacation Responder

• JMAP VacationResponse singleton management
• Settings tab with date range and message configuration
• Sidebar indicator when vacation auto-reply is active
• i18n support (all 8 languages)

Email Display

• Proper email layout without horizontal scroll or clipping
• Blocked image container collapsing (no empty spaces in newsletters)

Testing

• Unit tests for validation utilities (57 tests)
• Unit tests for email sanitization (27 tests)
• Unit tests for color transformation (40 tests)
• Unit tests for contact store (56 tests)
• Unit tests for JMAP contact client (41 tests)
• Unit tests for vCard parser (18 tests)
• Unit tests for thread utilities (20 tests)
• Unit tests for email headers (39 tests)
• Component tests (contacts, UI components — 41 tests)
• JMAP client method tests (identity: 20, contacts: 41)
• XSS attack vector testing
• Playwright E2E framework setup

Deployment

• Runtime environment variables (Docker-friendly configuration)
• Health check endpoint
• Docker support (multi-stage build, docker-compose, standalone output)
• Structured server-side logger (text/JSON format, configurable level)

Planned Features

Advanced Features

• Email filters and rules
• Calendar integration (JMAP Calendars)
• Email templates
• Email encryption (PGP/GPG)
• OAuth2/OIDC authentication (opt-in, Basic Auth remains default)

Performance Optimizations

• Email content caching
• Bundle size optimization
• Service worker for offline support
• Lazy loading for attachments

Testing (Remaining)

• E2E tests with real JMAP server
• Accessibility testing
• Performance testing

Deployment

• Production build optimizations
• Monitoring and logging

Security Enhancements

• Rate limiting
• CORS configuration

Known Issues

• Next.js workspace root warning (cosmetic)

Contributing

Want to help implement a feature? Check out our CONTRIBUTING.md guide!