Commit graph

15 commits

Author SHA1 Message Date
53261dec0c Add backend validation for aliases
- Validate source email format (RFC 5321 local-part)
- Ensure source is in the correct domain
- Validate destination (single or comma-separated emails)
- Check for duplicate aliases
- Add GetAliasBySource database method
2026-03-24 21:57:32 +01:00
abd7e3a97f Remove password reset functionality
Backend:
- Remove ForgotPassword API handler
- Remove password reset token model and database table
- Remove email service for sending reset emails
- Remove SMTP configuration

Frontend:
- Remove /auth/forgot page
- Remove forgot password link from login page
- Remove forgot route from auth-only routes check
2026-03-23 22:35:30 +01:00
9c8d982230 Add missing comments to response.go and middleware.go for better code documentation 2026-03-23 22:14:35 +01:00
269fb6f53a Security fixes
1. Password reset tokens: use crypto/rand instead of math/rand
2. IP spoofing: only trust X-Forwarded-For from configured trusted proxies
3. Cleanup: purge failed login attempts older than 24 hours
4. JWT secret: validate minimum 32 character length on startup

Updated .env.example with TRUSTED_PROXIES setting
2026-03-23 01:09:26 +01:00
c5a9149220 Get real mailbox size from dovecot
- Add mail.GetQuota() using doveadm quota get
- Fix UserWithQuota response struct
- Fix frontend NaN display with Unknown fallback
- Update field names to camelCase (usedQuota)
2026-03-23 00:24:40 +01:00
16b6d9df60 Fix email local part validation per RFC 5321
- Remove dots from character class (handled separately)
- Check username doesn't start/end with dot
- Check for no consecutive dots (..)
- Valid chars: a-zA-Z0-9!#$%&'*+-/=?^_`{|}~-
2026-03-23 00:16:15 +01:00
f9ddfa869e Validate email local part when creating users
- Check length (1-64 characters)
- Allow only valid email characters (RFC 5321)
- Return ValidationError with descriptive message
2026-03-23 00:13:35 +01:00
36258bf53c Sort domains alphabetically
- GetAllDomains: order by name ASC
- GetUserAccessibleDomains: order by name ASC for both admin and regular users
2026-03-23 00:11:03 +01:00
9dab3bc12c Add domain name validation
- Validate domain name format: letters, numbers, dots, hyphens only
- Must have at least one dot (TLD required)
- Cannot start/end with dot or hyphen
- Label length 1-63 characters
- Return ValidationError with descriptive message
2026-03-22 23:52:37 +01:00
4378bd0a99 Fix: move domain Create/Delete to /api/domains (not /api/admin) 2026-03-22 23:42:12 +01:00
2834657125 Switch from net/http to gin-gonic web framework
- Added gin-gonic v1.10.0 dependency
- Refactored router.go: clean route groups with middleware chains
- Refactored all handlers to use gin.Context instead of http.ResponseWriter/*http.Request
- Simplified response helpers (JSON, Error, Success, Created, NoContent)
- Clean auth middleware using Gin's c.Set() for context
- Cleaner route definitions with path parameters (e.g., /domains/:name/users/:id)
- Admin routes moved to /api/admin group with RequireAdmin middleware
2026-03-22 23:28:28 +01:00
060f88dffe Fix mail queue and logs commands
- Hardcode paths: /usr/sbin/postqueue, /usr/sbin/postsuper, /usr/bin/journalctl
- Fix postqueue: remove -p flag (conflicts with -j)
- Add stderr logging for queue errors
2026-03-22 01:40:06 +01:00
53ce3b06ae Add CLI flags for setup and server configuration
- Add --setup flag to create admin user
- Add --admin-user and --admin-password for setup
- Generate cryptographically random passwords for --setup
- Add --bind and --port flags for server binding
- Add BIND env var support
- Add SMTP email service for password reset
- Add password reset token storage
- Add auth header to queue/logs frontend pages
- Fix journalctl timestamp format
- Fix logs to return empty array instead of error when no entries
- Fix queue handler to return proper error message
- Hide Users/Aliases nav links when no domain selected
2026-03-22 01:17:43 +01:00
3cb21bf5cf remove build artifacts that should not be checked in 2026-03-21 23:57:01 +01:00
f4be03ceba first 2026-03-21 22:41:23 +01:00