Commit graph

59 commits

Author SHA1 Message Date
6b0e91798f Restrict email local part to safe characters only
Remove backtick, curly braces, pipe, and slash from allowed characters.
Keep underscore as it's commonly used and widely supported.
2026-03-26 00:49:35 +01:00
da037e9a79 Remove underscore from allowed email local part characters
Underscore is technically allowed by RFC 5321 but causes issues with
many email systems in practice.
2026-03-26 00:48:34 +01:00
d562e41528 Add directory structure documentation to README 2026-03-26 00:37:50 +01:00
b7d58d308a Remove redundant backend/.env.example (merged into root .env.example) 2026-03-26 00:25:16 +01:00
99d994544d Remove SMTP settings from .env.example 2026-03-26 00:25:08 +01:00
270cee44ff Change Go module path to git.workaround.org
- Update module path from github.com/imc/backend to git.workaround.org/chaas/imc/backend
- Update git remote to use git.workaround.org
2026-03-24 23:50:34 +01:00
061126c51e Fix remaining imc-vibe references in README and bun.lock 2026-03-24 23:44:56 +01:00
ff52be8adf Rename project from imc-vibe to imc
- Binary name: imc-vibe -> imc
- Go module: github.com/imc-vibe/backend -> github.com/imc/backend
- JWT issuer: imc-vibe -> imc
- UI labels: IMC Vibe -> IMC
- Update all imports and comments
2026-03-24 23:42:37 +01:00
a4c6b04b37 Fix make dev: use full path to air binary 2026-03-24 22:53:13 +01:00
53261dec0c Add backend validation for aliases
- Validate source email format (RFC 5321 local-part)
- Ensure source is in the correct domain
- Validate destination (single or comma-separated emails)
- Check for duplicate aliases
- Add GetAliasBySource database method
2026-03-24 21:57:32 +01:00
25a3eae628 Show selected domain name centered in navbar 2026-03-23 22:38:31 +01:00
aba8801d21 Update README to reflect removal of password reset functionality 2026-03-23 22:37:46 +01:00
abd7e3a97f Remove password reset functionality
Backend:
- Remove ForgotPassword API handler
- Remove password reset token model and database table
- Remove email service for sending reset emails
- Remove SMTP configuration

Frontend:
- Remove /auth/forgot page
- Remove forgot password link from login page
- Remove forgot route from auth-only routes check
2026-03-23 22:35:30 +01:00
c459cc1efb Simplify change-password page: remove duplicate header, use main layout navbar, align buttons right 2026-03-23 22:29:18 +01:00
629c66cc34 Fix layout rendering for /auth/change-password page
The change-password page was showing both the main layout sidebar
and its own header. Now only auth-only routes (login, forgot)
skip the main layout.
2026-03-23 22:17:32 +01:00
9c8d982230 Add missing comments to response.go and middleware.go for better code documentation 2026-03-23 22:14:35 +01:00
94d504ee1e Ignore backend/tmp directory created by air hot-reloader 2026-03-23 22:12:03 +01:00
516efcebd7 Add Vite proxy for API requests to backend during development
Proxy /api/* to http://localhost:8080 so dev frontend can call backend API.
2026-03-23 22:03:24 +01:00
88c870ab3c Restore --reset-admin-password flag for CLI admin password reset 2026-03-23 21:58:41 +01:00
1ac8c2de5a Fix .air.toml configuration and add PATH for air binary 2026-03-23 21:50:19 +01:00
ad159b2549 Add hot-reload support with air for Go backend
- Add .air.toml configuration for Go hot-reloading
- Add 'dev' target to run both frontend and backend together
- Update dev-backend to use air instead of go run
- Install air with: go install github.com/air-verse/air@latest
2026-03-23 21:40:40 +01:00
44dea14885 Fix .env loading for dev-backend: check parent dir when in backend/ 2026-03-23 21:38:07 +01:00
6e3d63f9c2 Fix dev-backend to run from project root where .env is located 2026-03-23 21:36:42 +01:00
f48d5631e7 Consolidate to single .env file in project root 2026-03-23 21:35:36 +01:00
b76ea568ae Remove ADMIN_PASSWORD configuration
Authentication now works only via hashed passwords in imc_users table.
Users must be created through the password reset flow or directly in the database.
2026-03-23 21:28:52 +01:00
3e30f3845d Add .env.example template and remove plaintext passwords
- Add .env.example with all configuration options documented
- Remove ADMIN_PASSWORD from .env files
- Set password via environment variable or --reset-admin-password flag
2026-03-23 21:25:55 +01:00
b1f24c42ab Add app.css with Tailwind and daisyUI imports 2026-03-23 21:19:46 +01:00
bb3f82d69d Update .gitignore to exclude node_modules, binaries, and build artifacts 2026-03-23 21:19:01 +01:00
f48a6fcd72 Update package dependencies for daisyUI migration 2026-03-23 21:12:07 +01:00
d76af4e427 Fix a11y warnings in layout dropdown
- Add svelte-ignore for daisyUI tabindex requirement
- Change logout <a> to <button> for proper semantics
2026-03-23 21:11:11 +01:00
0217f0b4c4 Complete daisyUI migration with CSS fixes
- Migrate all pages to daisyUI components
- Add data-theme="light" to app.html for proper theme
- Fix config to load .env from multiple locations
- Update avatar to use avatar-placeholder pattern
- Use @tailwindcss/vite plugin instead of PostCSS
2026-03-23 21:09:32 +01:00
70aa813c7f Remove unused CSS from domains page 2026-03-23 01:10:56 +01:00
269fb6f53a Security fixes
1. Password reset tokens: use crypto/rand instead of math/rand
2. IP spoofing: only trust X-Forwarded-For from configured trusted proxies
3. Cleanup: purge failed login attempts older than 24 hours
4. JWT secret: validate minimum 32 character length on startup

Updated .env.example with TRUSTED_PROXIES setting
2026-03-23 01:09:26 +01:00
ccaa1eca7e Decode JWT client-side instead of calling /api/auth/me
- Add lib/auth.ts with decodeJWT() and isTokenValid()
- Layout decodes JWT directly - no extra request
- Domains page also uses JWT for admin check
- Removed redundant user.domains from domains list page
2026-03-23 00:57:36 +01:00
19360e9a9f Show mailbox usage as percentage
- Add formatUsed() showing 'X GB (Y%)' format
- Fallback to 'Unknown' if quota data unavailable
2026-03-23 00:31:01 +01:00
9f77540c7b Show 0 bytes instead of 'Default' for used storage
- Separate formatBytes() for used storage
- formatQuota() keeps 'Default' only for unlimited quota
2026-03-23 00:28:59 +01:00
c5a9149220 Get real mailbox size from dovecot
- Add mail.GetQuota() using doveadm quota get
- Fix UserWithQuota response struct
- Fix frontend NaN display with Unknown fallback
- Update field names to camelCase (usedQuota)
2026-03-23 00:24:40 +01:00
16b6d9df60 Fix email local part validation per RFC 5321
- Remove dots from character class (handled separately)
- Check username doesn't start/end with dot
- Check for no consecutive dots (..)
- Valid chars: a-zA-Z0-9!#$%&'*+-/=?^_`{|}~-
2026-03-23 00:16:15 +01:00
f9ddfa869e Validate email local part when creating users
- Check length (1-64 characters)
- Allow only valid email characters (RFC 5321)
- Return ValidationError with descriptive message
2026-03-23 00:13:35 +01:00
36258bf53c Sort domains alphabetically
- GetAllDomains: order by name ASC
- GetUserAccessibleDomains: order by name ASC for both admin and regular users
2026-03-23 00:11:03 +01:00
c692fe436f Improve user/alias creation forms
- Prefill domain part in forms (e.g. input + @domain.com)
- Use native <dialog> element for modals
- Show error messages instead of alert()
- Cleaner input group styling
2026-03-23 00:00:42 +01:00
5c3e4ce7d8 Use native HTML <dialog> element for modals
Replaced CSS-based modal with native HTML <dialog> element.
Cleaner code, better accessibility, built-in backdrop handling.
2026-03-22 23:56:56 +01:00
a8aaa08d29 Show validation errors in domain creation form
Frontend now displays backend error messages when domain creation fails.
2026-03-22 23:54:34 +01:00
9dab3bc12c Add domain name validation
- Validate domain name format: letters, numbers, dots, hyphens only
- Must have at least one dot (TLD required)
- Cannot start/end with dot or hyphen
- Label length 1-63 characters
- Return ValidationError with descriptive message
2026-03-22 23:52:37 +01:00
118b709275 Fix: domain delete uses name instead of id
Backend routes expect domain name (string), not id (number).
Frontend was passing domain.id but should pass domain.name.
2026-03-22 23:44:14 +01:00
4378bd0a99 Fix: move domain Create/Delete to /api/domains (not /api/admin) 2026-03-22 23:42:12 +01:00
2834657125 Switch from net/http to gin-gonic web framework
- Added gin-gonic v1.10.0 dependency
- Refactored router.go: clean route groups with middleware chains
- Refactored all handlers to use gin.Context instead of http.ResponseWriter/*http.Request
- Simplified response helpers (JSON, Error, Success, Created, NoContent)
- Clean auth middleware using Gin's c.Set() for context
- Cleaner route definitions with path parameters (e.g., /domains/:name/users/:id)
- Admin routes moved to /api/admin group with RequireAdmin middleware
2026-03-22 23:28:28 +01:00
68285d861a Add comprehensive human-readable comments to all Go files
- Comments explain what each function does and why
- Fixed unused strconv import in queue.go
- Better documentation for SMTP email service
- Explained journalctl log parsing in logs.go
- Clarified queue operations in queue.go
2026-03-22 22:43:41 +01:00
3e3620a24f Remove USE_EMBEDDED option - always use embedded frontend 2026-03-22 22:08:45 +01:00
4b9db2c242 Use standard flag package with custom help format for double-hyphen style 2026-03-22 21:50:18 +01:00