Commit graph

52 commits

Author SHA1 Message Date
ff52be8adf Rename project from imc-vibe to imc
- Binary name: imc-vibe -> imc
- Go module: github.com/imc-vibe/backend -> github.com/imc/backend
- JWT issuer: imc-vibe -> imc
- UI labels: IMC Vibe -> IMC
- Update all imports and comments
2026-03-24 23:42:37 +01:00
a4c6b04b37 Fix make dev: use full path to air binary 2026-03-24 22:53:13 +01:00
53261dec0c Add backend validation for aliases
- Validate source email format (RFC 5321 local-part)
- Ensure source is in the correct domain
- Validate destination (single or comma-separated emails)
- Check for duplicate aliases
- Add GetAliasBySource database method
2026-03-24 21:57:32 +01:00
25a3eae628 Show selected domain name centered in navbar 2026-03-23 22:38:31 +01:00
aba8801d21 Update README to reflect removal of password reset functionality 2026-03-23 22:37:46 +01:00
abd7e3a97f Remove password reset functionality
Backend:
- Remove ForgotPassword API handler
- Remove password reset token model and database table
- Remove email service for sending reset emails
- Remove SMTP configuration

Frontend:
- Remove /auth/forgot page
- Remove forgot password link from login page
- Remove forgot route from auth-only routes check
2026-03-23 22:35:30 +01:00
c459cc1efb Simplify change-password page: remove duplicate header, use main layout navbar, align buttons right 2026-03-23 22:29:18 +01:00
629c66cc34 Fix layout rendering for /auth/change-password page
The change-password page was showing both the main layout sidebar
and its own header. Now only auth-only routes (login, forgot)
skip the main layout.
2026-03-23 22:17:32 +01:00
9c8d982230 Add missing comments to response.go and middleware.go for better code documentation 2026-03-23 22:14:35 +01:00
94d504ee1e Ignore backend/tmp directory created by air hot-reloader 2026-03-23 22:12:03 +01:00
516efcebd7 Add Vite proxy for API requests to backend during development
Proxy /api/* to http://localhost:8080 so dev frontend can call backend API.
2026-03-23 22:03:24 +01:00
88c870ab3c Restore --reset-admin-password flag for CLI admin password reset 2026-03-23 21:58:41 +01:00
1ac8c2de5a Fix .air.toml configuration and add PATH for air binary 2026-03-23 21:50:19 +01:00
ad159b2549 Add hot-reload support with air for Go backend
- Add .air.toml configuration for Go hot-reloading
- Add 'dev' target to run both frontend and backend together
- Update dev-backend to use air instead of go run
- Install air with: go install github.com/air-verse/air@latest
2026-03-23 21:40:40 +01:00
44dea14885 Fix .env loading for dev-backend: check parent dir when in backend/ 2026-03-23 21:38:07 +01:00
6e3d63f9c2 Fix dev-backend to run from project root where .env is located 2026-03-23 21:36:42 +01:00
f48d5631e7 Consolidate to single .env file in project root 2026-03-23 21:35:36 +01:00
b76ea568ae Remove ADMIN_PASSWORD configuration
Authentication now works only via hashed passwords in imc_users table.
Users must be created through the password reset flow or directly in the database.
2026-03-23 21:28:52 +01:00
3e30f3845d Add .env.example template and remove plaintext passwords
- Add .env.example with all configuration options documented
- Remove ADMIN_PASSWORD from .env files
- Set password via environment variable or --reset-admin-password flag
2026-03-23 21:25:55 +01:00
b1f24c42ab Add app.css with Tailwind and daisyUI imports 2026-03-23 21:19:46 +01:00
bb3f82d69d Update .gitignore to exclude node_modules, binaries, and build artifacts 2026-03-23 21:19:01 +01:00
f48a6fcd72 Update package dependencies for daisyUI migration 2026-03-23 21:12:07 +01:00
d76af4e427 Fix a11y warnings in layout dropdown
- Add svelte-ignore for daisyUI tabindex requirement
- Change logout <a> to <button> for proper semantics
2026-03-23 21:11:11 +01:00
0217f0b4c4 Complete daisyUI migration with CSS fixes
- Migrate all pages to daisyUI components
- Add data-theme="light" to app.html for proper theme
- Fix config to load .env from multiple locations
- Update avatar to use avatar-placeholder pattern
- Use @tailwindcss/vite plugin instead of PostCSS
2026-03-23 21:09:32 +01:00
70aa813c7f Remove unused CSS from domains page 2026-03-23 01:10:56 +01:00
269fb6f53a Security fixes
1. Password reset tokens: use crypto/rand instead of math/rand
2. IP spoofing: only trust X-Forwarded-For from configured trusted proxies
3. Cleanup: purge failed login attempts older than 24 hours
4. JWT secret: validate minimum 32 character length on startup

Updated .env.example with TRUSTED_PROXIES setting
2026-03-23 01:09:26 +01:00
ccaa1eca7e Decode JWT client-side instead of calling /api/auth/me
- Add lib/auth.ts with decodeJWT() and isTokenValid()
- Layout decodes JWT directly - no extra request
- Domains page also uses JWT for admin check
- Removed redundant user.domains from domains list page
2026-03-23 00:57:36 +01:00
19360e9a9f Show mailbox usage as percentage
- Add formatUsed() showing 'X GB (Y%)' format
- Fallback to 'Unknown' if quota data unavailable
2026-03-23 00:31:01 +01:00
9f77540c7b Show 0 bytes instead of 'Default' for used storage
- Separate formatBytes() for used storage
- formatQuota() keeps 'Default' only for unlimited quota
2026-03-23 00:28:59 +01:00
c5a9149220 Get real mailbox size from dovecot
- Add mail.GetQuota() using doveadm quota get
- Fix UserWithQuota response struct
- Fix frontend NaN display with Unknown fallback
- Update field names to camelCase (usedQuota)
2026-03-23 00:24:40 +01:00
16b6d9df60 Fix email local part validation per RFC 5321
- Remove dots from character class (handled separately)
- Check username doesn't start/end with dot
- Check for no consecutive dots (..)
- Valid chars: a-zA-Z0-9!#$%&'*+-/=?^_`{|}~-
2026-03-23 00:16:15 +01:00
f9ddfa869e Validate email local part when creating users
- Check length (1-64 characters)
- Allow only valid email characters (RFC 5321)
- Return ValidationError with descriptive message
2026-03-23 00:13:35 +01:00
36258bf53c Sort domains alphabetically
- GetAllDomains: order by name ASC
- GetUserAccessibleDomains: order by name ASC for both admin and regular users
2026-03-23 00:11:03 +01:00
c692fe436f Improve user/alias creation forms
- Prefill domain part in forms (e.g. input + @domain.com)
- Use native <dialog> element for modals
- Show error messages instead of alert()
- Cleaner input group styling
2026-03-23 00:00:42 +01:00
5c3e4ce7d8 Use native HTML <dialog> element for modals
Replaced CSS-based modal with native HTML <dialog> element.
Cleaner code, better accessibility, built-in backdrop handling.
2026-03-22 23:56:56 +01:00
a8aaa08d29 Show validation errors in domain creation form
Frontend now displays backend error messages when domain creation fails.
2026-03-22 23:54:34 +01:00
9dab3bc12c Add domain name validation
- Validate domain name format: letters, numbers, dots, hyphens only
- Must have at least one dot (TLD required)
- Cannot start/end with dot or hyphen
- Label length 1-63 characters
- Return ValidationError with descriptive message
2026-03-22 23:52:37 +01:00
118b709275 Fix: domain delete uses name instead of id
Backend routes expect domain name (string), not id (number).
Frontend was passing domain.id but should pass domain.name.
2026-03-22 23:44:14 +01:00
4378bd0a99 Fix: move domain Create/Delete to /api/domains (not /api/admin) 2026-03-22 23:42:12 +01:00
2834657125 Switch from net/http to gin-gonic web framework
- Added gin-gonic v1.10.0 dependency
- Refactored router.go: clean route groups with middleware chains
- Refactored all handlers to use gin.Context instead of http.ResponseWriter/*http.Request
- Simplified response helpers (JSON, Error, Success, Created, NoContent)
- Clean auth middleware using Gin's c.Set() for context
- Cleaner route definitions with path parameters (e.g., /domains/:name/users/:id)
- Admin routes moved to /api/admin group with RequireAdmin middleware
2026-03-22 23:28:28 +01:00
68285d861a Add comprehensive human-readable comments to all Go files
- Comments explain what each function does and why
- Fixed unused strconv import in queue.go
- Better documentation for SMTP email service
- Explained journalctl log parsing in logs.go
- Clarified queue operations in queue.go
2026-03-22 22:43:41 +01:00
3e3620a24f Remove USE_EMBEDDED option - always use embedded frontend 2026-03-22 22:08:45 +01:00
4b9db2c242 Use standard flag package with custom help format for double-hyphen style 2026-03-22 21:50:18 +01:00
1c9578cb56 Use double-hyphen style CLI flags with pflag 2026-03-22 21:49:04 +01:00
6ef558d44d Simplify CLI: replace --setup with --reset-admin-password flag
- Remove --setup and --admin-user flags
- Add --reset-admin-password flag that generates random password and exits
- Admin username is now always 'admin'
2026-03-22 21:47:23 +01:00
554b731ea8 Add README.md 2026-03-22 12:36:11 +01:00
060f88dffe Fix mail queue and logs commands
- Hardcode paths: /usr/sbin/postqueue, /usr/sbin/postsuper, /usr/bin/journalctl
- Fix postqueue: remove -p flag (conflicts with -j)
- Add stderr logging for queue errors
2026-03-22 01:40:06 +01:00
d56722ddb9 Remove build artifacts from repository tracking 2026-03-22 01:19:55 +01:00
53ce3b06ae Add CLI flags for setup and server configuration
- Add --setup flag to create admin user
- Add --admin-user and --admin-password for setup
- Generate cryptographically random passwords for --setup
- Add --bind and --port flags for server binding
- Add BIND env var support
- Add SMTP email service for password reset
- Add password reset token storage
- Add auth header to queue/logs frontend pages
- Fix journalctl timestamp format
- Fix logs to return empty array instead of error when no entries
- Fix queue handler to return proper error message
- Hide Users/Aliases nav links when no domain selected
2026-03-22 01:17:43 +01:00
2c3a4c3daa Fix Svelte reactive state warnings and update gitignore 2026-03-22 00:04:41 +01:00