A manual zone has no Cloudflare records to read, so the Resend and SES receiving checks reported 'MX record points to Resend' as failed even when the MX was right. Manual zones are now checked against public DNS, and a lookup that cannot run says so instead of failing the step.
A Resend domain with nothing else to name a DKIM selector is checked at resend._domainkey, which is the record Resend asks for.
Co-authored-by: Can Kirca <9063990+cankirca@users.noreply.github.com>
The reset mail was hardcoded in English. It now uses the language from the
preference cookie of the browser that asked for the reset, with English as the
fallback for any string a catalog does not have yet. English and Turkish are
translated.
Co-authored-by: Can Kirca <9063990+cankirca@users.noreply.github.com>
In conversation view a row's unread state was computed from every message in
the thread, in any folder, while marking the row read only touches the messages
shown in the current folder. A thread with an unread message in another folder
(or Sent rows for an unread thread) looked unread and stayed that way. The
unread count is now taken from the same messages the row stands for.
The sidebar Inbox count moved by one for any row action or bulk action. It now
moves by the number of unread messages the action actually flips, only in the
Inbox, and bulk read/unread updates the conversation rows too.
Permanent delete returned how many messages it skipped but the client ignored
it, so a partly failed delete looked like a success. It now refreshes the list
and shows a message.
Co-authored-by: Can Kirca <9063990+cankirca@users.noreply.github.com>
Attachments added to a draft are now uploaded with the autosave, so closing
the composer no longer drops them. Autosaves run one at a time, so typing
while the first save is still in flight no longer creates a second draft.
The schedule pickers no longer accept a time that has already passed. The
current minute and anything later is allowed. /api/send rejects a time more
than a minute in the past instead of sending immediately.
Co-authored-by: Can Kirca <9063990+cankirca@users.noreply.github.com>
Inbound messages never stored their Reply-To header, so Reply and Reply all
in the reader always addressed the From address. Mail from a contact form
(From: no-reply@site, Reply-To: visitor) was answered to the no-reply box.
Store the full Reply-To list in a new messages.reply_to column on delivery
and import, use it as the reply target in getReplyRecipients (falling back
to From when it names only the mailbox's own addresses), surface it on JMAP
Email objects, and let the agent's draft_reply read the column before
falling back to parsing the raw MIME for older rows.
Message attachments honoured the sender's inline disposition for any type, and
the Drive and preview checks compared raw Content-Type strings, so
image/svg+xml;charset=utf-8 or image/png, text/html passed. The per-route CSP
sandbox was the only guard, and on the Node runtime Next.js drops it in favour of
the global CSP from next.config, which allows inline script.
Parse the MIME essence, allowlist inline types, and send back only the parsed
type.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* Give pages a title, one h1 and unique landmarks
Settings, admin, calendar, booking, drive and compose pages kept the title of whatever page was shown before, because only the mail folders updated document.title. A small RouteTitle component, mounted in each layout, now sets "<page> - <app name>" from a table of the existing navigation labels. The sign-in, forgot-password and reset-password pages get their own titles from generateMetadata.
Headings: the folder list on the desktop layout had no h1 (it was only rendered on narrow screens), and the admin pages hid their h1 with display: none on phones in favour of an h2 outside the main landmark. The list now always has a heading (an h2 when a message with its own h1 is open), the visible title next to the toolbar is decorative, admin pages keep their h1 on phones through sr-only, the mobile top bar title is decorative, and the calendar, account, inbox settings, import, export and rules pages get a screen-reader-only h1. The admin overview cards use h2 so the heading levels no longer skip.
Landmarks: the sidebar nav is named after the app and the settings navs after their sections, so they can be told apart. The admin page chrome (license badge and account menu) is a header instead of a bare span, so it is inside a landmark.
* Test the route title lookup
Covers the longest-prefix match and the routes that keep their own title.
---------
Co-authored-by: Can Kirca <9063990+cankirca@users.noreply.github.com>
Co-authored-by: Hieu Nguyen (Jack) <nc.hieu@live.com>
Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
useHotkeys pushed every keydown into the sequence buffer and only matched when the whole buffer equalled a shortcut. Two things broke that: the Shift keydown of "g" then "!" put "shift" in the buffer (so "g !", go to Spam, never matched), and any key pressed within 800 ms before a sequence (for example "j" and then "g i") left a stale entry in front of it.
Modifier keys no longer enter the buffer, and a sequence now matches when it ends the buffer. A single key still only matches as the whole buffer, so lone shortcuts behave as before. The matching moved to use-hotkeys-utils.ts with a small test.
Co-authored-by: Can Kirca <9063990+cankirca@users.noreply.github.com>
Marking a message as spam, moving it to Trash or archiving it from the reading view took you to the Spam, Trash or Archive folder. You now go back to the list you opened the message from, so you can keep working through it. The same goes for blocking a sender, which always jumped to Trash.
getMessageActionRedirect takes the list's href instead of a direction, and the message actions read it from the list visibility context the folder pages already provide, so custom folders work too.
Co-authored-by: Can Kirca <9063990+cankirca@users.noreply.github.com>
* Mark the fixture admin as primary admin in the account tests
Creating accounts needs a primary admin or an admin with user management rights since migration 0050, but the fixture inserted its admin without is_primary_admin, so every create call got a 403.
* Let the agent tool test call mutating tools without chat approval
In chat, mark_email_read, move_email and discard_draft now return pending_approval instead of acting. The test still expected the change to happen right away. It now checks that chat only asks, and runs the direct calls with the mcp origin.
* Test the migrated schema instead of the removed bootstrap SQL
The old test read MIGRATION_NAMES and INITIAL_SCHEMA_SQL out of src/lib/setup/migration.ts, which now just runs the migration files. The replacement applies drizzle/migrations to an empty database, checks that every file is recorded and not re-applied, and keeps the mailbox, license and spam table checks.
* Expect the shortened pt-BR inbox label in the i18n tests
6978c01 changed navigation.inbox from "Caixa de entrada" to "Entrada" in pt-BR, but four tests still expected the old label.
---------
Co-authored-by: Can Kirca <9063990+cankirca@users.noreply.github.com>
* Render the branded page title on the server
The root layout sent a fixed "Mailflare" title and the browser swapped in the configured app name after the page loaded. Screen readers announced both. The title now comes from the branding settings in the first response, and the branding is passed to the provider as its initial value so the name and the icon do not flash their defaults first.
The inbox page also kept its own "Inbox (n)" title after leaving it, so the sign-in page after a logout still read as the inbox. It now puts the previous title back when it unmounts.
* Stub the branding lookup in the layout i18n test
The root layout now reads the app name from the server, which pulls in the Workers runtime. The i18n test bundles the layout with stubs for its server-only imports, so add one for the branding helper too.
---------
Co-authored-by: Can Kirca <9063990+cankirca@users.noreply.github.com>
Saving credentials that validate against AWS but carry no SES permissions
answers 400 with "Attach the policy shown below", yet the panel rendered
nothing below it. Two causes: the 400 body carried the report but not the
policy, and requestJson discarded the parsed body on a rejected response,
so the report never reached the panel. The block was also gated on
`configured && !editing`, which is exactly the state a refused save leaves.
The 400 now carries the policy, requestJson throws an ApiError that keeps
the parsed body, and the panel keeps a refused report so the missing
permissions and the policy render under the message, expanded. A later
successful save, re-check, replace or remove clears it.
Refs #79
- t(key, vars) interpolates {placeholders}; numeric count picks a CLDR plural variant
- createTranslator(locale) shares the translator with server code
- registry entries accept dir: "rtl"; layout and provider set <html dir>
- DialogContent translates its close label itself (closeLabel stays an override)
- memoize the language context value, merge double map in dashboard-nav
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Stub the DOM-only email HTML module in the recipient-display test bundle,
since css-tree/parse5 do not bundle for node. Add contain:paint to the
reader host so fixed/absolute email CSS cannot cover the app UI.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
- IMAP import: walk a folder newest-first in batches of up to 100 via an
`offset` / `nextOffset` pair, so folders with more than 100 messages can be
imported completely. The import page loops until every folder is done and
shows progress. The per-request limit stays at 100 (default 100).
- IMAP import: recognise iCloud `Sent Messages` and `Deleted Messages`.
- Agent model list: use `redirect: "manual"` instead of `"error"` so
providers that redirect do not fail the request with a generic error.
- Domains: require typing the hostname before removing a domain, since
removal deletes the domain's mailboxes and all their messages.
- Add tests for the batch selection helper.
Adds a "Delete forever" action and an "Empty Trash"/"Empty Spam" button so
mail can be removed for good from the web UI (closes#68, part 1).
- Bulk action "delete" only destroys messages already in Trash or Spam
- POST /api/messages/empty empties a mailbox's Trash or Spam in batches
- Message view: the delete button becomes "Delete forever" in Trash/Spam
- Every removal deletes R2 objects and writes an email.delete audit entry
The domain rule dialog submits its whole form state, so "Deliver to
mailbox" and "Reject / block" rules arrive with forwardTo: "". The
schema only allowed an email or null, so those requests failed with a
400 that the dialog shows as "Request failed". This blocked creating
the "*" catch-all, editing such rules, and toggling them on or off.
Treat a blank forwardTo as null. Forward rules still require a valid
address through the existing superRefine check.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Inbound To no longer says "me". To, Cc, and Bcc show the mailbox
address. A switch on the signed-in user, under Settings → Inbox,
shows Name <user@domain.tld> when the header includes a display name.
* fix(jmap): answer the header filter in Email/query instead of ignoring it
conditionToSql() had no `header` branch, so a condition it did not
recognise was dropped and the query matched every message in the
mailbox. A client that de-duplicates drafts by Message-ID before
importing therefore either adopted an unrelated draft or refused to
send because "multiple remote drafts" came back.
Handle `header` per RFC 8621 §4.4.1 from the columns Mailflare already
stores — Message-ID, In-Reply-To and References — and make every other
header name an `unsupportedFilter` error, which is what RFC 8620 §5.5
requires of a filter the server cannot apply. Message-IDs compare
without angle brackets, since inbound rows store them and outbound rows
do not, and header names are matched case-insensitively.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* feat(jmap): Email/import so MIME-composing clients can send
Clients that build MIME locally — Flectar Mail and anything else on the
jmap-client crate — send by uploading the raw message, importing it into
Drafts and submitting it. Email/import answered `unknownMethod`, so
reading worked but every send failed.
Implement it for the Drafts mailbox (RFC 8621 §4.8). The blob must be an
upload this account owns, the target exactly one Drafts mailbox, and the
parsed From has to pass the same getAuthorizedSenderAddress() check a
draft created through Email/set does; anything else comes back in
notCreated as blobNotFound, invalidProperties, invalidEmail, forbidden
or tooLarge. Importing into arbitrary mailboxes is deliberately left
out: delivered mail belongs to the inbound pipeline, which owns
threading, spam scoring and inbound state.
The parsed headers fill the same columns Email/set create writes —
Email/set create and Email/import now share one insert and one target
rule — plus providerMessageId, which is what lets the client find its
own draft again with a Message-ID filter. The uploaded bytes are kept
verbatim under `drafts/<messageId>.eml`, so downloading the message's
blob returns the client's own MIME instead of the rebuilt minimal
message, and the jmap-uploads object is released once claimed.
Email/copy and Email/parse stay unsupported.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* test(jmap): cover Email/import validation and the header filter
tests/jmap-email-import.test.mjs is a node:test file over the pure
pieces — the mailbox rule, keyword and receivedAt parsing, and the SQL
Email/query builds for header conditions, including the unsupportedFilter
throw and the regression that a Message-ID filter narrows the mailbox
instead of matching every draft. The modules are TypeScript behind the
`@/*` alias, so they are bundled with the esbuild the repo already uses
for the self-hosted server rather than loaded directly; nothing here
needs a Workers binding.
scripts/jmap-import-check.mjs is the end-to-end pass against
`npm run dev`: upload a multipart message with an attachment, import it,
read it back, download the blob byte-for-byte, query it by Message-ID,
submit it, and check every rejection path.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* docs(jmap): document Email/import and the header query filter
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix(jmap): clean up imported draft objects
---------
Co-authored-by: egamer24 <25360766+egamer24@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Hieu Nguyen (Jack) <nc.hieu@live.com>
Self-hosted Node/Docker has no Email Worker named mailflare, so the
catch-all PUT 404s (Cloudflare code 2016) during domain setup even when
CF_TOKEN can edit zone routing. Gate ensureEmailRoutingCatchAllToWorker
with isNodeRuntime; Workers still bind catch-all as before.
Renaming any personal mailbox renamed all of them. The account profile and
every personal mailbox shared one identity: syncPersonalIdentity wrote the
profile name and avatar to every row matching (userId, type = 'personal'),
PATCH /api/mailboxes/[id] redirected a rename into that sync instead of the
mailbox row, and both the list response and the client overrode whatever was
stored with the account name. Outgoing mail and message lists did the same,
so a secondary mailbox also sent under the account owner's name.
Only the primary mailbox — the one at the account address — carries the
account identity now. Every other personal mailbox keeps the name and avatar
it was given. The rule lives in one place, lib/profile/identity-utils.ts, and
the API routes, the sender, and the client all go through it.
Existing secondary mailboxes keep whatever name the old blanket update left
on them until they are renamed; the rename now sticks.
Fixes#36
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
才倾梦华V