Commit graph

25 commits

Author SHA1 Message Date
3198819f75 Remove domains from auth API responses
- Remove Domains field from UserResponse struct
- Login and Me endpoints no longer return domains
- Domains should be fetched separately from /api/domains
2026-03-29 22:28:54 +02:00
8b2d2649ac Add random password generation for new users
- Move GenerateRandomPassword to auth package for reuse
- Make password optional in user creation (generates 16-char if empty)
- Return generated password in response for user to copy
- Add Generate/Copy UI with show/hide toggle
2026-03-29 14:52:59 +02:00
c4e3a31b69 Complete GORM to sqlc migration
- Remove GORM dependency, use sqlc for type-safe SQL queries
- Update all handlers to use sqlc patterns (context, value types)
- Fix N+1 query problem in domain listing with JOIN query
- Enable SQL query logging in debug mode (USE_EMBEDDED=false)
- Add comprehensive comments for non-Go developers
2026-03-29 13:56:14 +02:00
dad96978e0 WIP: Migrate from GORM to sqlc - partial migration, build broken 2026-03-28 18:26:45 +01:00
560b40503a Migrate GORM to generics API, simplify user-domain relationship, refactor models 2026-03-28 17:21:00 +01:00
d5880d5096 Rename ISPmail models to use Virtual* prefix
- Domain -> VirtualDomain
- User -> VirtualUser
- Alias -> VirtualAlias

This clarifies which tables are ISPmail tables vs IMC tables.
2026-03-26 23:34:05 +01:00
6b0e91798f Restrict email local part to safe characters only
Remove backtick, curly braces, pipe, and slash from allowed characters.
Keep underscore as it's commonly used and widely supported.
2026-03-26 00:49:35 +01:00
da037e9a79 Remove underscore from allowed email local part characters
Underscore is technically allowed by RFC 5321 but causes issues with
many email systems in practice.
2026-03-26 00:48:34 +01:00
270cee44ff Change Go module path to git.workaround.org
- Update module path from github.com/imc/backend to git.workaround.org/chaas/imc/backend
- Update git remote to use git.workaround.org
2026-03-24 23:50:34 +01:00
ff52be8adf Rename project from imc-vibe to imc
- Binary name: imc-vibe -> imc
- Go module: github.com/imc-vibe/backend -> github.com/imc/backend
- JWT issuer: imc-vibe -> imc
- UI labels: IMC Vibe -> IMC
- Update all imports and comments
2026-03-24 23:42:37 +01:00
53261dec0c Add backend validation for aliases
- Validate source email format (RFC 5321 local-part)
- Ensure source is in the correct domain
- Validate destination (single or comma-separated emails)
- Check for duplicate aliases
- Add GetAliasBySource database method
2026-03-24 21:57:32 +01:00
abd7e3a97f Remove password reset functionality
Backend:
- Remove ForgotPassword API handler
- Remove password reset token model and database table
- Remove email service for sending reset emails
- Remove SMTP configuration

Frontend:
- Remove /auth/forgot page
- Remove forgot password link from login page
- Remove forgot route from auth-only routes check
2026-03-23 22:35:30 +01:00
9c8d982230 Add missing comments to response.go and middleware.go for better code documentation 2026-03-23 22:14:35 +01:00
269fb6f53a Security fixes
1. Password reset tokens: use crypto/rand instead of math/rand
2. IP spoofing: only trust X-Forwarded-For from configured trusted proxies
3. Cleanup: purge failed login attempts older than 24 hours
4. JWT secret: validate minimum 32 character length on startup

Updated .env.example with TRUSTED_PROXIES setting
2026-03-23 01:09:26 +01:00
c5a9149220 Get real mailbox size from dovecot
- Add mail.GetQuota() using doveadm quota get
- Fix UserWithQuota response struct
- Fix frontend NaN display with Unknown fallback
- Update field names to camelCase (usedQuota)
2026-03-23 00:24:40 +01:00
16b6d9df60 Fix email local part validation per RFC 5321
- Remove dots from character class (handled separately)
- Check username doesn't start/end with dot
- Check for no consecutive dots (..)
- Valid chars: a-zA-Z0-9!#$%&'*+-/=?^_`{|}~-
2026-03-23 00:16:15 +01:00
f9ddfa869e Validate email local part when creating users
- Check length (1-64 characters)
- Allow only valid email characters (RFC 5321)
- Return ValidationError with descriptive message
2026-03-23 00:13:35 +01:00
36258bf53c Sort domains alphabetically
- GetAllDomains: order by name ASC
- GetUserAccessibleDomains: order by name ASC for both admin and regular users
2026-03-23 00:11:03 +01:00
9dab3bc12c Add domain name validation
- Validate domain name format: letters, numbers, dots, hyphens only
- Must have at least one dot (TLD required)
- Cannot start/end with dot or hyphen
- Label length 1-63 characters
- Return ValidationError with descriptive message
2026-03-22 23:52:37 +01:00
4378bd0a99 Fix: move domain Create/Delete to /api/domains (not /api/admin) 2026-03-22 23:42:12 +01:00
2834657125 Switch from net/http to gin-gonic web framework
- Added gin-gonic v1.10.0 dependency
- Refactored router.go: clean route groups with middleware chains
- Refactored all handlers to use gin.Context instead of http.ResponseWriter/*http.Request
- Simplified response helpers (JSON, Error, Success, Created, NoContent)
- Clean auth middleware using Gin's c.Set() for context
- Cleaner route definitions with path parameters (e.g., /domains/:name/users/:id)
- Admin routes moved to /api/admin group with RequireAdmin middleware
2026-03-22 23:28:28 +01:00
060f88dffe Fix mail queue and logs commands
- Hardcode paths: /usr/sbin/postqueue, /usr/sbin/postsuper, /usr/bin/journalctl
- Fix postqueue: remove -p flag (conflicts with -j)
- Add stderr logging for queue errors
2026-03-22 01:40:06 +01:00
53ce3b06ae Add CLI flags for setup and server configuration
- Add --setup flag to create admin user
- Add --admin-user and --admin-password for setup
- Generate cryptographically random passwords for --setup
- Add --bind and --port flags for server binding
- Add BIND env var support
- Add SMTP email service for password reset
- Add password reset token storage
- Add auth header to queue/logs frontend pages
- Fix journalctl timestamp format
- Fix logs to return empty array instead of error when no entries
- Fix queue handler to return proper error message
- Hide Users/Aliases nav links when no domain selected
2026-03-22 01:17:43 +01:00
3cb21bf5cf remove build artifacts that should not be checked in 2026-03-21 23:57:01 +01:00
f4be03ceba first 2026-03-21 22:41:23 +01:00