Add embedded IMAP/SMTP mail for staff
Admins configure one mail server; each staff member gets their own mailbox login. Read, reply and compose against real IMAP/SMTP. IMAP and SMTP are raw TCP, so none of this can run in a browser — every operation is a TanStack Start server function. mail.functions.ts ships to the client bundle, so imapflow/nodemailer/mailparser and the crypto helpers are imported inside handlers, never at the top level. Verified that Nitro inlines all three into .output/server/_libs, since the Docker runner stage copies only .output and has no node_modules. Note this ties the app to the Node deployment: the default local build targets Cloudflare Workers, which cannot open IMAP sockets. Credential handling, since a mailbox password grants full read and send access to someone's mail: - user_mailboxes has RLS enabled, no policies, and SELECT revoked from anon and authenticated. Verified: teacher and admin both see zero rows and no ciphertext; only service_role can read it. The revoke is belt and braces — Supabase's default privileges had granted SELECT, leaving the table one stray policy away from leaking. - Passwords are sealed with AES-256-GCM using MAIL_CRED_KEY from .env.secret, so a database dump alone opens nothing. GCM also makes tampering fail the auth tag instead of decrypting to garbage. - Provisioning verifies credentials against the live IMAP server before storing them, so typos surface at setup rather than as a broken inbox. Message bodies render as plain text; sender HTML is never injected, which would execute sender-controlled markup and leak read receipts via tracking pixels. Mailboxes are limited to admins and teachers. Students are excluded deliberately — external mail for minors carries archiving, monitoring and consent obligations that should be chosen, not inherited. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Claude Opus 5
@@ -43,8 +43,11 @@
|
||||
"cmdk": "^1.1.1",
|
||||
"date-fns": "^4.1.0",
|
||||
"embla-carousel-react": "^8.6.0",
|
||||
"imapflow": "^1.5.0",
|
||||
"input-otp": "^1.4.2",
|
||||
"lucide-react": "^0.575.0",
|
||||
"mailparser": "^3.9.14",
|
||||
"nodemailer": "^9.0.3",
|
||||
"react": "^19.2.0",
|
||||
"react-day-picker": "^9.14.0",
|
||||
"react-dom": "^19.2.0",
|
||||
@@ -62,7 +65,9 @@
|
||||
"devDependencies": {
|
||||
"@eslint/js": "^9.32.0",
|
||||
"@lovable.dev/vite-tanstack-config": "2.6.4",
|
||||
"@types/mailparser": "^3.4.6",
|
||||
"@types/node": "^22.16.5",
|
||||
"@types/nodemailer": "^8.0.1",
|
||||
"@types/react": "^19.2.0",
|
||||
"@types/react-dom": "^19.2.0",
|
||||
"@vitejs/plugin-react": "^5.2.0",
|
||||
@@ -255,6 +260,8 @@
|
||||
|
||||
"@oxc-project/types": ["@oxc-project/types@0.134.0", "", {}, "sha512-T0xuRRKrQFmocH8y+jGfpmSkGcheaJExY9lEihmR1Gm2aH+75B8CzgU2rABRQSzzDxLjZ15Sc0bRVLj5lVeNXQ=="],
|
||||
|
||||
"@pinojs/redact": ["@pinojs/redact@0.4.0", "", {}, "sha512-k2ENnmBugE/rzQfEcdWHcCY+/FM3VLzH9cYEsbdsoqrvzAKRhUZeRNhAZvB8OitQJ1TBed3yqWtdjzS6wJKBwg=="],
|
||||
|
||||
"@pkgr/core": ["@pkgr/core@0.2.9", "", {}, "sha512-QNqXyfVS2wm9hweSYD2O7F0G06uurj9kZ96TRQE5Y9hU7+tgdZwIkbAKc5Ocy1HxEY2kuDQa6cQ1WRs/O5LFKA=="],
|
||||
|
||||
"@radix-ui/number": ["@radix-ui/number@1.1.1", "", {}, "sha512-MkKCwxlXTgz6CFoJx3pCwn07GKp36+aZyu/u2Ln2VrA5DcdyCZkASEDBTd8x5whTQQL5CiYf4prXKLcgQdv29g=="],
|
||||
@@ -447,6 +454,8 @@
|
||||
|
||||
"@rollup/rollup-win32-x64-msvc": ["@rollup/rollup-win32-x64-msvc@4.60.2", "", { "os": "win32", "cpu": "x64" }, "sha512-Nd/SgG27WoA9e+/TdK74KnHz852TLa94ovOYySo/yMPuTmpckK/jIF2jSwS3g7ELSKXK13/cVdmg1Z/DaCWKxA=="],
|
||||
|
||||
"@selderee/plugin-htmlparser2": ["@selderee/plugin-htmlparser2@0.12.0", "", { "dependencies": { "domelementtype": "~2.3.0", "domhandler": "~5.0.3" }, "peerDependencies": { "selderee": "~0.12.0" } }, "sha512-oELmoyA6ML9jDRMV3kgcMQFKxUfBU0yFVn6yTctVaLT5ygXnxH52I3TZEgV9EhXJC68/uFvE5Daj1/25c0Xa/A=="],
|
||||
|
||||
"@standard-schema/utils": ["@standard-schema/utils@0.3.0", "", {}, "sha512-e7Mew686owMaPJVNNLs55PUvgz371nKgwsc4vxE49zsODpJEnxgxRo2y/OKrqueavXgZNMDVj3DdHFlaSAeU8g=="],
|
||||
|
||||
"@supabase/auth-js": ["@supabase/auth-js@2.108.2", "https://europe-west1-npm.pkg.dev/lovable-core-prod/sandbox-npm-cache/@supabase/auth-js/-/auth-js-2.108.2.tgz", { "dependencies": { "tslib": "2.8.1" } }, "sha512-tNaQmBgodDZwgB40mRwVbxFy8IDYwjdpcZ0BYrWiwlULCSQoJj4QoG4zgJT7QRPXcqipefNOzvO/qAu4dF98ag=="],
|
||||
@@ -567,8 +576,12 @@
|
||||
|
||||
"@types/json-schema": ["@types/json-schema@7.0.15", "", {}, "sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA=="],
|
||||
|
||||
"@types/mailparser": ["@types/mailparser@3.4.6", "", { "dependencies": { "@types/node": "*", "iconv-lite": "^0.6.3" } }, "sha512-wVV3cnIKzxTffaPH8iRnddX1zahbYB1ZEoAxyhoBo3TBCBuK6nZ8M8JYO/RhsCuuBVOw/DEN/t/ENbruwlxn6Q=="],
|
||||
|
||||
"@types/node": ["@types/node@22.19.17", "", { "dependencies": { "undici-types": "~6.21.0" } }, "sha512-wGdMcf+vPYM6jikpS/qhg6WiqSV/OhG+jeeHT/KlVqxYfD40iYJf9/AE1uQxVWFvU7MipKRkRv8NSHiCGgPr8Q=="],
|
||||
|
||||
"@types/nodemailer": ["@types/nodemailer@8.0.1", "", { "dependencies": { "@types/node": "*" } }, "sha512-PxpaInm8V1JQDd4j0ds5HfvWQk8JupS1C0Picb96QJsrrRDjBH+DlK7L4ZdNSqNULhiZRQHc40nLVShaGxXAMw=="],
|
||||
|
||||
"@types/react": ["@types/react@19.2.14", "", { "dependencies": { "csstype": "^3.2.2" } }, "sha512-ilcTH/UniCkMdtexkoCN0bI7pMcJDvmQFPvuPvmEaYA/NSfFTAgdUSLAoVjaRJm7+6PvcM+q1zYOwS4wTYMF9w=="],
|
||||
|
||||
"@types/react-dom": ["@types/react-dom@19.2.3", "", { "peerDependencies": { "@types/react": "^19.2.0" } }, "sha512-jp2L/eY6fn+KgVVQAOqYItbF0VY/YApe5Mz2F0aykSO8gx31bYCZyvSeYxCHKvzHG5eZjc+zyaS5BrBWya2+kQ=="],
|
||||
@@ -595,6 +608,8 @@
|
||||
|
||||
"@vitejs/plugin-react": ["@vitejs/plugin-react@5.2.0", "", { "dependencies": { "@babel/core": "^7.29.0", "@babel/plugin-transform-react-jsx-self": "^7.27.1", "@babel/plugin-transform-react-jsx-source": "^7.27.1", "@rolldown/pluginutils": "1.0.0-rc.3", "@types/babel__core": "^7.20.5", "react-refresh": "^0.18.0" }, "peerDependencies": { "vite": "^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0" } }, "sha512-YmKkfhOAi3wsB1PhJq5Scj3GXMn3WvtQ/JC0xoopuHoXSdmtdStOpFrYaT1kie2YgFBcIe64ROzMYRjCrYOdYw=="],
|
||||
|
||||
"@zone-eu/mailsplit": ["@zone-eu/mailsplit@5.4.14", "", { "dependencies": { "libbase64": "1.3.0", "libmime": "5.4.1", "libqp": "2.1.1" } }, "sha512-rz0FQOhN3Vq1XrSeSSa9+dPcaFbBxmQPjiZm6zS9oxdVHV7rOWIAYX3yP2YAUf0qBncY8CI+NogzPCmMVrMXcw=="],
|
||||
|
||||
"acorn": ["acorn@8.16.0", "", { "bin": { "acorn": "bin/acorn" } }, "sha512-UVJyE9MttOsBQIDKw1skb9nAwQuR5wuGD3+82K6JgJlm/Y+KI92oNsMNGZCYdDsVtRHSak0pcV5Dno5+4jh9sw=="],
|
||||
|
||||
"acorn-jsx": ["acorn-jsx@5.3.2", "", { "peerDependencies": { "acorn": "^6.0.0 || ^7.0.0 || ^8.0.0" } }, "sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ=="],
|
||||
@@ -615,6 +630,8 @@
|
||||
|
||||
"aria-hidden": ["aria-hidden@1.2.6", "", { "dependencies": { "tslib": "^2.0.0" } }, "sha512-ik3ZgC9dY/lYVVM++OISsaYDeg1tb0VtP5uL3ouh1koGOaUMDPpbFIei4JkFimWUFPn90sbMNMXQAIVOlnYKJA=="],
|
||||
|
||||
"atomic-sleep": ["atomic-sleep@1.0.0", "", {}, "sha512-kNOjDqAh7px0XWNI+4QbzoiR/nTkHAWNud2uvnJquD1/x5a7EQZMJT0AczqK0Qn67oY/TTQ1LbUKajZpp3I9tQ=="],
|
||||
|
||||
"babel-dead-code-elimination": ["babel-dead-code-elimination@1.0.12", "", { "dependencies": { "@babel/core": "^7.23.7", "@babel/parser": "^7.23.6", "@babel/traverse": "^7.23.7", "@babel/types": "^7.23.6" } }, "sha512-GERT7L2TiYcYDtYk1IpD+ASAYXjKbLTDPhBtYj7X1NuRMDTMtAx9kyBenub1Ev41lo91OHCKdmP+egTDmfQ7Ig=="],
|
||||
|
||||
"balanced-match": ["balanced-match@1.0.2", "", {}, "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="],
|
||||
@@ -701,6 +718,8 @@
|
||||
|
||||
"deep-is": ["deep-is@0.1.4", "", {}, "sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ=="],
|
||||
|
||||
"deepmerge-ts": ["deepmerge-ts@7.1.5", "", {}, "sha512-HOJkrhaYsweh+W+e74Yn7YStZOilkoPb6fycpwNLKzSPtruFs48nYis0zy5yJz1+ktUhHxoRDJ27RQAWLIJVJw=="],
|
||||
|
||||
"detect-libc": ["detect-libc@2.1.2", "", {}, "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ=="],
|
||||
|
||||
"detect-node-es": ["detect-node-es@1.1.0", "", {}, "sha512-ypdmJU/TbBby2Dxibuv7ZLW3Bs1QEmM7nHjEANfohJLvE0XVujisn1qPJcZxg+qDucsr+bP6fLD1rPS3AhJ7EQ=="],
|
||||
@@ -713,6 +732,14 @@
|
||||
|
||||
"dom-helpers": ["dom-helpers@5.2.1", "", { "dependencies": { "@babel/runtime": "^7.8.7", "csstype": "^3.0.2" } }, "sha512-nRCa7CK3VTrM2NmGkIy4cbK7IZlgBE/PYMn55rrXefr5xXDP0LdtfPnblFDoVdcAfslJ7or6iqAUnx0CCGIWQA=="],
|
||||
|
||||
"dom-serializer": ["dom-serializer@2.0.0", "", { "dependencies": { "domelementtype": "^2.3.0", "domhandler": "^5.0.2", "entities": "^4.2.0" } }, "sha512-wIkAryiqt/nV5EQKqQpo3SToSOV9J0DnbJqwK7Wv/Trc92zIAYZ4FlMu+JPFW1DfGFt81ZTCGgDEabffXeLyJg=="],
|
||||
|
||||
"domelementtype": ["domelementtype@2.3.0", "", {}, "sha512-OLETBj6w0OsagBwdXnPdN0cnMfF9opN69co+7ZrbfPGrdpPVNBUj02spi6B1N7wChLQiPn4CSH/zJvXw56gmHw=="],
|
||||
|
||||
"domhandler": ["domhandler@5.0.3", "", { "dependencies": { "domelementtype": "^2.3.0" } }, "sha512-cgwlv/1iFQiFnU96XXgROh8xTeetsnJiDsTc7TYCLFd9+/WNkIqPTxiM/8pSd8VIrhXGTf1Ny1q1hquVqDJB5w=="],
|
||||
|
||||
"domutils": ["domutils@3.2.2", "", { "dependencies": { "dom-serializer": "^2.0.0", "domelementtype": "^2.3.0", "domhandler": "^5.0.3" } }, "sha512-6kZKyUajlDuqlHKVX1w7gyslj9MPIXzIFiz/rGu35uC1wMi+kMhQwGhl4lt9unC9Vb9INnY9Z3/ZA3+FhASLaw=="],
|
||||
|
||||
"electron-to-chromium": ["electron-to-chromium@1.5.344", "", {}, "sha512-4MxfbmNDm+KPh066EZy+eUnkcDPcZ35wNmOWzFuh/ijvHsve6kbLTLURy88uCNK5FbpN+yk2nQY6BYh1GEt+wg=="],
|
||||
|
||||
"embla-carousel": ["embla-carousel@8.6.0", "", {}, "sha512-SjWyZBHJPbqxHOzckOfo8lHisEaJWmwd23XppYFYVh10bU66/Pn5tkVkbkCMZVdbUE5eTCI2nD8OyIP4Z+uwkA=="],
|
||||
@@ -721,8 +748,12 @@
|
||||
|
||||
"embla-carousel-reactive-utils": ["embla-carousel-reactive-utils@8.6.0", "", { "peerDependencies": { "embla-carousel": "8.6.0" } }, "sha512-fMVUDUEx0/uIEDM0Mz3dHznDhfX+znCCDCeIophYb1QGVM7YThSWX+wz11zlYwWFOr74b4QLGg0hrGPJeG2s4A=="],
|
||||
|
||||
"encoding-japanese": ["encoding-japanese@2.2.0", "", {}, "sha512-EuJWwlHPZ1LbADuKTClvHtwbaFn4rOD+dRAbWysqEOXRc2Uui0hJInNJrsdH0c+OhJA4nrCBdSkW4DD5YxAo6A=="],
|
||||
|
||||
"enhanced-resolve": ["enhanced-resolve@5.20.1", "", { "dependencies": { "graceful-fs": "^4.2.4", "tapable": "^2.3.0" } }, "sha512-Qohcme7V1inbAfvjItgw0EaxVX5q2rdVEZHRBrEQdRZTssLDGsL8Lwrznl8oQ/6kuTJONLaDcGjkNP247XEhcA=="],
|
||||
|
||||
"entities": ["entities@4.5.0", "", {}, "sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw=="],
|
||||
|
||||
"env-runner": ["env-runner@0.1.9", "", { "dependencies": { "crossws": "^0.4.5", "exsolve": "^1.0.8", "httpxy": "^0.5.3", "srvx": "^0.11.15" }, "peerDependencies": { "@netlify/runtime": "^4.1.23", "@vercel/queue": "^0.2.0", "miniflare": "^4.20260515.0" }, "optionalPeers": ["@netlify/runtime", "@vercel/queue", "miniflare"], "bin": { "env-runner": "dist/cli.mjs" } }, "sha512-W9AiZlPx0uXtghAJiTBkeZOgyQdecVvoln3cHoOEZswPq0cVMi+WBhUQjdUn+JcZFAFgOt+i5fcO7C2zniZoCg=="],
|
||||
|
||||
"es-errors": ["es-errors@1.3.0", "", {}, "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw=="],
|
||||
@@ -815,14 +846,24 @@
|
||||
|
||||
"hasown": ["hasown@2.0.3", "", { "dependencies": { "function-bind": "^1.1.2" } }, "sha512-ej4AhfhfL2Q2zpMmLo7U1Uv9+PyhIZpgQLGT1F9miIGmiCJIoCgSmczFdrc97mWT4kVY72KA+WnnhJ5pghSvSg=="],
|
||||
|
||||
"he": ["he@1.2.0", "", { "bin": { "he": "bin/he" } }, "sha512-F/1DnUGPopORZi0ni+CvrCgHQ5FyEAHRLSApuYWMmrbSwoN2Mn/7k+Gl38gJnR7yyDZk6WLXwiGod1JOWNDKGw=="],
|
||||
|
||||
"hookable": ["hookable@6.1.1", "", {}, "sha512-U9LYDy1CwhMCnprUfeAZWZGByVbhd54hwepegYTK7Pi5NvqEj63ifz5z+xukznehT7i6NIZRu89Ay1AZmRsLEQ=="],
|
||||
|
||||
"html-to-text": ["html-to-text@10.0.0", "", { "dependencies": { "@selderee/plugin-htmlparser2": "~0.12.0", "deepmerge-ts": "^7.1.5", "dom-serializer": "^2.0.0", "htmlparser2": "^10.1.0", "selderee": "~0.12.0" } }, "sha512-2OH59Gtprdczel+7Rxgpz9hGVJREaf8Lt1H4kZwWHpEn70VQKRuMNGsb2eDbwaTzrYzb0hheiOG1P7Dim0B4dQ=="],
|
||||
|
||||
"htmlparser2": ["htmlparser2@10.1.0", "", { "dependencies": { "domelementtype": "^2.3.0", "domhandler": "^5.0.3", "domutils": "^3.2.2", "entities": "^7.0.1" } }, "sha512-VTZkM9GWRAtEpveh7MSF6SjjrpNVNNVJfFup7xTY3UpFtm67foy9HDVXneLtFVt4pMz5kZtgNcvCniNFb1hlEQ=="],
|
||||
|
||||
"httpxy": ["httpxy@0.5.3", "", {}, "sha512-SMS9V6Sn7VWaS11lYhoAr0ceoaiolTWf4jYdJn0NJhCdKMu9R2H9Fh0LBDWBHQF6HRLI1PmaePYsjanSpE5PEw=="],
|
||||
|
||||
"iceberg-js": ["iceberg-js@0.8.1", "https://europe-west1-npm.pkg.dev/lovable-core-prod/sandbox-npm-cache/iceberg-js/-/iceberg-js-0.8.1.tgz", {}, "sha512-1dhVQZXhcHje7798IVM+xoo/1ZdVfzOMIc8/rgVSijRK38EDqOJoGula9N/8ZI5RD8QTxNQtK/Gozpr+qUqRRA=="],
|
||||
|
||||
"iconv-lite": ["iconv-lite@0.6.3", "", { "dependencies": { "safer-buffer": ">= 2.1.2 < 3.0.0" } }, "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw=="],
|
||||
|
||||
"ignore": ["ignore@5.3.2", "", {}, "sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g=="],
|
||||
|
||||
"imapflow": ["imapflow@1.5.0", "", { "dependencies": { "@zone-eu/mailsplit": "5.4.14", "encoding-japanese": "2.2.0", "iconv-lite": "0.7.3", "libbase64": "1.3.0", "libmime": "5.4.1", "libqp": "2.1.1", "nodemailer": "9.0.3", "pino": "10.3.1", "socks": "2.8.9" } }, "sha512-ayj2xIpRpXT9nXlAQQDhfm694faQxEmfAzRYL881q3YGRR5ofyIWsG3l3Lf7oSThxgLwZ/EQ5kh/nLnKBud3LQ=="],
|
||||
|
||||
"import-fresh": ["import-fresh@3.3.1", "", { "dependencies": { "parent-module": "^1.0.0", "resolve-from": "^4.0.0" } }, "sha512-TR3KfrTZTYLPB6jUjfx6MF9WcWrHL9su5TObK4ZkYgBdWKPOFoSoQIdEuTuR82pmtxH2spWG9h6etwfr1pLBqQ=="],
|
||||
|
||||
"imurmurhash": ["imurmurhash@0.1.4", "", {}, "sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA=="],
|
||||
@@ -831,6 +872,8 @@
|
||||
|
||||
"internmap": ["internmap@2.0.3", "", {}, "sha512-5Hh7Y1wQbvY5ooGgPbDaL5iYLAPzMTUrjMulskHLH6wnv/A+1q5rgEaiuqEjB+oxGXIVZs1FF+R/KPN3ZSQYYg=="],
|
||||
|
||||
"ip-address": ["ip-address@10.3.1", "", {}, "sha512-1e9d3kb97NHJTIJDZW9rKqW2h6+dFa50Dy0fpPSMQp2ADje5gvKsXmdiK6dwY5t76TaTt5+P5N1Y/LoToIxP6g=="],
|
||||
|
||||
"is-binary-path": ["is-binary-path@2.1.0", "", { "dependencies": { "binary-extensions": "^2.0.0" } }, "sha512-ZMERYes6pDydyuGidse7OsHxtbI7WVeUEozgR/g7rd0xUimYNlvZRE/K2MgZTjWy725IfelLeVcEM97mmtRGXw=="],
|
||||
|
||||
"is-core-module": ["is-core-module@2.16.1", "", { "dependencies": { "hasown": "^2.0.2" } }, "sha512-UfoeMA6fIJ8wTYFEUjelnaGI67v6+N7qXJEvQuIGa99l4xsCruSYOVSQ0uPANn4dAzm8lkYPaKLrrijLq7x23w=="],
|
||||
@@ -863,8 +906,16 @@
|
||||
|
||||
"keyv": ["keyv@4.5.4", "", { "dependencies": { "json-buffer": "3.0.1" } }, "sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw=="],
|
||||
|
||||
"leac": ["leac@0.7.0", "", {}, "sha512-qMrZeyEekgdRQ9o6a4NAB2EQZrv827GJdn1vnapwSJ90hWRB4TzUSunvacPkxQ2TnNqHNI1/zSt0hlo0crG8Jw=="],
|
||||
|
||||
"levn": ["levn@0.4.1", "", { "dependencies": { "prelude-ls": "^1.2.1", "type-check": "~0.4.0" } }, "sha512-+bT2uH4E5LGE7h/n3evcS/sQlJXCpIp6ym8OWJ5eV6+67Dsql/LaaT7qJBAt2rzfoa/5QBGBhxDix1dMt2kQKQ=="],
|
||||
|
||||
"libbase64": ["libbase64@1.3.0", "", {}, "sha512-GgOXd0Eo6phYgh0DJtjQ2tO8dc0IVINtZJeARPeiIJqge+HdsWSuaDTe8ztQ7j/cONByDZ3zeB325AHiv5O0dg=="],
|
||||
|
||||
"libmime": ["libmime@5.4.1", "", { "dependencies": { "encoding-japanese": "2.2.0", "iconv-lite": "0.7.3", "libbase64": "1.3.0", "libqp": "2.1.1" } }, "sha512-0wHGhsofo9IdQPenr3BBHXuxcwMq4atFUTsZ9Ogc1OvI5h4rUdDIrBQEN9JHjCXfDMrE59LUMJWsTD82wTYk8A=="],
|
||||
|
||||
"libqp": ["libqp@2.1.1", "", {}, "sha512-0Wd+GPz1O134cP62YU2GTOPNA7Qgl09XwCqM5zpBv87ERCXdfDtyKXvV7c9U22yWJh44QZqBocFnXN11K96qow=="],
|
||||
|
||||
"lightningcss": ["lightningcss@1.32.0", "", { "dependencies": { "detect-libc": "^2.0.3" }, "optionalDependencies": { "lightningcss-android-arm64": "1.32.0", "lightningcss-darwin-arm64": "1.32.0", "lightningcss-darwin-x64": "1.32.0", "lightningcss-freebsd-x64": "1.32.0", "lightningcss-linux-arm-gnueabihf": "1.32.0", "lightningcss-linux-arm64-gnu": "1.32.0", "lightningcss-linux-arm64-musl": "1.32.0", "lightningcss-linux-x64-gnu": "1.32.0", "lightningcss-linux-x64-musl": "1.32.0", "lightningcss-win32-arm64-msvc": "1.32.0", "lightningcss-win32-x64-msvc": "1.32.0" } }, "sha512-NXYBzinNrblfraPGyrbPoD19C1h9lfI/1mzgWYvXUTe414Gz/X1FD2XBZSZM7rRTrMA8JL3OtAaGifrIKhQ5yQ=="],
|
||||
|
||||
"lightningcss-android-arm64": ["lightningcss-android-arm64@1.32.0", "", { "os": "android", "cpu": "arm64" }, "sha512-YK7/ClTt4kAK0vo6w3X+Pnm0D2cf2vPHbhOXdoNti1Ga0al1P4TBZhwjATvjNwLEBCnKvjJc2jQgHXH0NEwlAg=="],
|
||||
@@ -893,6 +944,8 @@
|
||||
|
||||
"lines-and-columns": ["lines-and-columns@1.2.4", "", {}, "sha512-7ylylesZQ/PV29jhEDl3Ufjo6ZX7gCqJr5F7PKrqc93v7fzSymt1BpwEU8nAUXs8qzzvqhbjhK5QZg6Mt/HkBg=="],
|
||||
|
||||
"linkify-it": ["linkify-it@5.0.2", "", { "dependencies": { "uc.micro": "^2.0.0" } }, "sha512-ONTm2jCMAVZjgQa/Fy1kScXsuOoF5NPTsoFBdE1KVIZ2vAh/r9+Bqo+0jINCBYnavTPQZz38QzFTme79ENoN3Q=="],
|
||||
|
||||
"locate-path": ["locate-path@6.0.0", "", { "dependencies": { "p-locate": "^5.0.0" } }, "sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw=="],
|
||||
|
||||
"lodash": ["lodash@4.18.1", "", {}, "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q=="],
|
||||
@@ -909,6 +962,8 @@
|
||||
|
||||
"magic-string": ["magic-string@0.30.21", "", { "dependencies": { "@jridgewell/sourcemap-codec": "^1.5.5" } }, "sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ=="],
|
||||
|
||||
"mailparser": ["mailparser@3.9.14", "", { "dependencies": { "@zone-eu/mailsplit": "5.4.14", "encoding-japanese": "2.2.0", "he": "1.2.0", "html-to-text": "10.0.0", "iconv-lite": "0.7.3", "libmime": "5.4.1", "linkify-it": "5.0.2", "nodemailer": "9.0.3", "punycode.js": "2.3.1", "tlds": "1.261.0" } }, "sha512-3QD6TRXcyXtq2NCuyA2AEjqmallQkyxYmZI9GMCIvQDCaB9Uc034WUI1x8RUBYFnk5+p7h14JEz4O/lrxQmttw=="],
|
||||
|
||||
"merge2": ["merge2@1.4.1", "", {}, "sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg=="],
|
||||
|
||||
"micromatch": ["micromatch@4.0.8", "", { "dependencies": { "braces": "^3.0.3", "picomatch": "^2.3.1" } }, "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA=="],
|
||||
@@ -929,6 +984,8 @@
|
||||
|
||||
"node-releases": ["node-releases@2.0.38", "", {}, "sha512-3qT/88Y3FbH/Kx4szpQQ4HzUbVrHPKTLVpVocKiLfoYvw9XSGOX2FmD2d6DrXbVYyAQTF2HeF6My8jmzx7/CRw=="],
|
||||
|
||||
"nodemailer": ["nodemailer@9.0.3", "", {}, "sha512-n+YP+NKwR5zRWa60k3GiQ6Q3B4KXCoAw40dAKeCtYn020iNN74aWK2liXIC3ZEATeGql7we3tE3t8QwhY0eskw=="],
|
||||
|
||||
"normalize-path": ["normalize-path@3.0.0", "", {}, "sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA=="],
|
||||
|
||||
"object-assign": ["object-assign@4.1.1", "", {}, "sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg=="],
|
||||
@@ -941,6 +998,8 @@
|
||||
|
||||
"ohash": ["ohash@2.0.11", "", {}, "sha512-RdR9FQrFwNBNXAr4GixM8YaRZRJ5PUWbKYbE5eOsrwAjJW0q2REGcf79oYPsLyskQCZG1PLN+S/K1V00joZAoQ=="],
|
||||
|
||||
"on-exit-leak-free": ["on-exit-leak-free@2.1.2", "", {}, "sha512-0eJJY6hXLGf1udHwfNftBqH+g73EU4B504nZeKpz1sYRKafAghwxEJunB2O7rDZkL4PGfsMVnTXZ2EjibbqcsA=="],
|
||||
|
||||
"optionator": ["optionator@0.9.4", "", { "dependencies": { "deep-is": "^0.1.3", "fast-levenshtein": "^2.0.6", "levn": "^0.4.1", "prelude-ls": "^1.2.1", "type-check": "^0.4.0", "word-wrap": "^1.2.5" } }, "sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g=="],
|
||||
|
||||
"p-limit": ["p-limit@3.1.0", "", { "dependencies": { "yocto-queue": "^0.1.0" } }, "sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ=="],
|
||||
@@ -949,6 +1008,8 @@
|
||||
|
||||
"parent-module": ["parent-module@1.0.1", "", { "dependencies": { "callsites": "^3.0.0" } }, "sha512-GQ2EWRpQV8/o+Aw8YqtfZZPfNRWZYkbidE9k5rpl/hC3vtHHBfGm2Ifi6qWV+coDGkrUKZAxE3Lot5kcsRlh+g=="],
|
||||
|
||||
"parseley": ["parseley@0.13.1", "", { "dependencies": { "leac": "^0.7.0", "peberminta": "^0.10.0" } }, "sha512-uNBJZzmb60l6p6VWLTmevizNAGnE0xoSf1n0B4q3ntegDNzcS68NRCcBDZTcyXHxt2XhBChsCuqj4M+nChvE/A=="],
|
||||
|
||||
"path-exists": ["path-exists@4.0.0", "", {}, "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w=="],
|
||||
|
||||
"path-key": ["path-key@3.1.1", "", {}, "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q=="],
|
||||
@@ -957,12 +1018,20 @@
|
||||
|
||||
"pathe": ["pathe@2.0.3", "", {}, "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w=="],
|
||||
|
||||
"peberminta": ["peberminta@0.10.0", "", {}, "sha512-80B2AsU+I4Qdb0ZAPSfe9UwvGzwkM37IKIFEvdS3D/3Ndgv2bsuJ0bfG1+iEYO+l7Gfd4EUJmuRyq7efLgRMzQ=="],
|
||||
|
||||
"picocolors": ["picocolors@1.1.1", "", {}, "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA=="],
|
||||
|
||||
"picomatch": ["picomatch@4.0.4", "", {}, "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A=="],
|
||||
|
||||
"pify": ["pify@2.3.0", "", {}, "sha512-udgsAY+fTnvv7kI7aaxbqwWNb0AHiB0qBO89PZKPkoTmGOgdbrHDKD+0B2X4uTfJ/FT1R09r9gTsjUjNJotuog=="],
|
||||
|
||||
"pino": ["pino@10.3.1", "", { "dependencies": { "@pinojs/redact": "^0.4.0", "atomic-sleep": "^1.0.0", "on-exit-leak-free": "^2.1.0", "pino-abstract-transport": "^3.0.0", "pino-std-serializers": "^7.0.0", "process-warning": "^5.0.0", "quick-format-unescaped": "^4.0.3", "real-require": "^0.2.0", "safe-stable-stringify": "^2.3.1", "sonic-boom": "^4.0.1", "thread-stream": "^4.0.0" }, "bin": { "pino": "bin.js" } }, "sha512-r34yH/GlQpKZbU1BvFFqOjhISRo1MNx1tWYsYvmj6KIRHSPMT2+yHOEb1SG6NMvRoHRF0a07kCOox/9yakl1vg=="],
|
||||
|
||||
"pino-abstract-transport": ["pino-abstract-transport@3.0.0", "", { "dependencies": { "split2": "^4.0.0" } }, "sha512-wlfUczU+n7Hy/Ha5j9a/gZNy7We5+cXp8YL+X+PG8S0KXxw7n/JXA3c46Y0zQznIJ83URJiwy7Lh56WLokNuxg=="],
|
||||
|
||||
"pino-std-serializers": ["pino-std-serializers@7.1.0", "", {}, "sha512-BndPH67/JxGExRgiX1dX0w1FvZck5Wa4aal9198SrRhZjH3GxKQUKIBnYJTdj2HDN3UQAS06HlfcSbQj2OHmaw=="],
|
||||
|
||||
"pirates": ["pirates@4.0.7", "", {}, "sha512-TfySrs/5nm8fQJDcBDuUng3VOUKsd7S+zqvbOTiGXHfxX4wK31ard+hoNuvkicM/2YFzlpDgABOevKSsB4G/FA=="],
|
||||
|
||||
"postcss": ["postcss@8.5.15", "", { "dependencies": { "nanoid": "^3.3.12", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" } }, "sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A=="],
|
||||
@@ -985,12 +1054,18 @@
|
||||
|
||||
"prettier-linter-helpers": ["prettier-linter-helpers@1.0.1", "", { "dependencies": { "fast-diff": "^1.1.2" } }, "sha512-SxToR7P8Y2lWmv/kTzVLC1t/GDI2WGjMwNhLLE9qtH8Q13C+aEmuRlzDst4Up4s0Wc8sF2M+J57iB3cMLqftfg=="],
|
||||
|
||||
"process-warning": ["process-warning@5.0.0", "", {}, "sha512-a39t9ApHNx2L4+HBnQKqxxHNs1r7KF+Intd8Q/g1bUh6q0WIp9voPXJ/x0j+ZL45KF1pJd9+q2jLIRMfvEshkA=="],
|
||||
|
||||
"prop-types": ["prop-types@15.8.1", "", { "dependencies": { "loose-envify": "^1.4.0", "object-assign": "^4.1.1", "react-is": "^16.13.1" } }, "sha512-oj87CgZICdulUohogVAR7AjlC0327U4el4L6eAvOqCeudMDVU0NThNaV+b9Df4dXgSP1gXMTnPdhfe/2qDH5cg=="],
|
||||
|
||||
"punycode": ["punycode@2.3.1", "", {}, "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg=="],
|
||||
|
||||
"punycode.js": ["punycode.js@2.3.1", "", {}, "sha512-uxFIHU0YlHYhDQtV4R9J6a52SLx28BCjT+4ieh7IGbgwVJWO+km431c4yRlREUAsAmt/uMjQUyQHNEPf0M39CA=="],
|
||||
|
||||
"queue-microtask": ["queue-microtask@1.2.3", "", {}, "sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A=="],
|
||||
|
||||
"quick-format-unescaped": ["quick-format-unescaped@4.0.4", "", {}, "sha512-tYC1Q1hgyRuHgloV/YXs2w15unPVh8qfu/qCTfhTYamaw7fyhumKa2yGpdSo87vY32rIclj+4fWYQXUMs9EHvg=="],
|
||||
|
||||
"react": ["react@19.2.5", "", {}, "sha512-llUJLzz1zTUBrskt2pwZgLq59AemifIftw4aB7JxOqf1HY2FDaGDxgwpAPVzHU1kdWabH7FauP4i1oEeer2WCA=="],
|
||||
|
||||
"react-day-picker": ["react-day-picker@9.14.0", "", { "dependencies": { "@date-fns/tz": "^1.4.1", "@tabby_ai/hijri-converter": "1.0.5", "date-fns": "^4.1.0", "date-fns-jalali": "4.1.0-0" }, "peerDependencies": { "react": ">=16.8.0" } }, "sha512-tBaoDWjPwe0M5pGrum4H0SR6Lyk+BO9oHnp9JbKpGKW2mlraNPgP9BMfsg5pWpwrssARmeqk7YBl2oXutZTaHA=="],
|
||||
@@ -1019,6 +1094,8 @@
|
||||
|
||||
"readdirp": ["readdirp@5.0.0", "", {}, "sha512-9u/XQ1pvrQtYyMpZe7DXKv2p5CNvyVwzUB6uhLAnQwHMSgKMBR62lc7AHljaeteeHXn11XTAaLLUVZYVZyuRBQ=="],
|
||||
|
||||
"real-require": ["real-require@0.2.0", "", {}, "sha512-57frrGM/OCTLqLOAh0mhVA9VBMHd+9U7Zb2THMGdBUoZVOtGbJzjxsYGDJ3A9AYYCP4hn6y1TVbaOfzWtm5GFg=="],
|
||||
|
||||
"recharts": ["recharts@2.15.4", "", { "dependencies": { "clsx": "^2.0.0", "eventemitter3": "^4.0.1", "lodash": "^4.17.21", "react-is": "^18.3.1", "react-smooth": "^4.0.4", "recharts-scale": "^0.4.4", "tiny-invariant": "^1.3.1", "victory-vendor": "^36.6.8" }, "peerDependencies": { "react": "^16.0.0 || ^17.0.0 || ^18.0.0 || ^19.0.0", "react-dom": "^16.0.0 || ^17.0.0 || ^18.0.0 || ^19.0.0" } }, "sha512-UT/q6fwS3c1dHbXv2uFgYJ9BMFHu3fwnd7AYZaEQhXuYQ4hgsxLvsUXzGdKeZrW5xopzDCvuA2N41WJ88I7zIw=="],
|
||||
|
||||
"recharts-scale": ["recharts-scale@0.4.5", "", { "dependencies": { "decimal.js-light": "^2.4.1" } }, "sha512-kivNFO+0OcUNu7jQquLXAxz1FIwZj8nrj+YkOKc5694NbjCvcT6aSZiIzNzd2Kul4o4rTto8QVR9lMNtxD4G1w=="],
|
||||
@@ -1039,8 +1116,14 @@
|
||||
|
||||
"run-parallel": ["run-parallel@1.2.0", "", { "dependencies": { "queue-microtask": "^1.2.2" } }, "sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA=="],
|
||||
|
||||
"safe-stable-stringify": ["safe-stable-stringify@2.5.0", "", {}, "sha512-b3rppTKm9T+PsVCBEOUR46GWI7fdOs00VKZ1+9c1EWDaDMvjQc6tUwuFyIprgGgTcWoVHSKrU8H31ZHA2e0RHA=="],
|
||||
|
||||
"safer-buffer": ["safer-buffer@2.1.2", "", {}, "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg=="],
|
||||
|
||||
"scheduler": ["scheduler@0.27.0", "", {}, "sha512-eNv+WrVbKu1f3vbYJT/xtiF5syA5HPIMtf9IgY/nKg0sWqzAUEvqY/xm7OcZc/qafLx/iO9FgOmeSAp4v5ti/Q=="],
|
||||
|
||||
"selderee": ["selderee@0.12.0", "", { "dependencies": { "parseley": "~0.13.1" } }, "sha512-b1YMh3+DHZp59DLna3qVwQ5iOla/nrI6mLBNW02XxU77M3046Df6VLkoaJyFz20VsGIG5kkp+FK0kg4K4HnUFw=="],
|
||||
|
||||
"semver": ["semver@6.3.1", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA=="],
|
||||
|
||||
"seroval": ["seroval@1.5.4", "", {}, "sha512-46uFvgrXTVxZcUorgSSRZ4y+ieqLLQRMlG4bnCZKW3qI6BZm7Rg4ntMW4p1mILEEBZWrFlcpp0AyIIlM6jD9iw=="],
|
||||
@@ -1051,12 +1134,20 @@
|
||||
|
||||
"shebang-regex": ["shebang-regex@3.0.0", "", {}, "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A=="],
|
||||
|
||||
"smart-buffer": ["smart-buffer@4.2.0", "", {}, "sha512-94hK0Hh8rPqQl2xXc3HsaBoOXKV20MToPkcXvwbISWLEs+64sBq5kFgn2kJDHb1Pry9yrP0dxrCI9RRci7RXKg=="],
|
||||
|
||||
"socks": ["socks@2.8.9", "", { "dependencies": { "ip-address": "^10.1.1", "smart-buffer": "^4.2.0" } }, "sha512-LJhUYUvItdQ0LkJTmPeaEObWXAqFyfmP85x0tch/ez9cahmhlBBLbIqDFnvBnUJGagb0JbIQrkBs1wJ+yRYpEw=="],
|
||||
|
||||
"sonic-boom": ["sonic-boom@4.2.1", "", { "dependencies": { "atomic-sleep": "^1.0.0" } }, "sha512-w6AxtubXa2wTXAUsZMMWERrsIRAdrK0Sc+FUytWvYAhBJLyuI4llrMIC1DtlNSdI99EI86KZum2MMq3EAZlF9Q=="],
|
||||
|
||||
"sonner": ["sonner@2.0.7", "", { "peerDependencies": { "react": "^18.0.0 || ^19.0.0 || ^19.0.0-rc", "react-dom": "^18.0.0 || ^19.0.0 || ^19.0.0-rc" } }, "sha512-W6ZN4p58k8aDKA4XPcx2hpIQXBRAgyiWVkYhT7CvK6D3iAu7xjvVyhQHg2/iaKJZ1XVJ4r7XuwGL+WGEK37i9w=="],
|
||||
|
||||
"source-map": ["source-map@0.7.6", "", {}, "sha512-i5uvt8C3ikiWeNZSVZNWcfZPItFQOsYTUAOkcUPGd8DqDy1uOUikjt5dG+uRlwyvR108Fb9DOd4GvXfT0N2/uQ=="],
|
||||
|
||||
"source-map-js": ["source-map-js@1.2.1", "", {}, "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA=="],
|
||||
|
||||
"split2": ["split2@4.2.0", "", {}, "sha512-UcjcJOWknrNkF6PLX83qcHM6KHgVKNkV62Y8a5uYDVv9ydGQVwAHMKqHdJje1VTWpljG0WYpCDhrCdAOYH4TWg=="],
|
||||
|
||||
"srvx": ["srvx@0.11.16", "", { "bin": { "srvx": "bin/srvx.mjs" } }, "sha512-bp07zRuycfTY43IjAvvTFnmnJi8ikW0VFiHwOhhYcVW/L4xQ1XY4PAd4Nuum1rsA17C39zL7x+CDhrn5AL32Rw=="],
|
||||
|
||||
"strip-json-comments": ["strip-json-comments@3.1.1", "", {}, "sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig=="],
|
||||
@@ -1079,10 +1170,14 @@
|
||||
|
||||
"thenify-all": ["thenify-all@1.6.0", "", { "dependencies": { "thenify": ">= 3.1.0 < 4" } }, "sha512-RNxQH/qI8/t3thXJDwcstUO4zeqo64+Uy/+sNVRBx4Xn2OX+OZ9oP+iJnNFqplFra2ZUVeKCSa2oVWi3T4uVmA=="],
|
||||
|
||||
"thread-stream": ["thread-stream@4.2.0", "", { "dependencies": { "real-require": "^1.0.0" } }, "sha512-e2zZ96wSChazBsbENf/Pcm/4swHt2cEKQ92rhUjkL9GCKiTDJIaTBenjE/m9DXi0QBmTMDkFDdOomUy20A1tDQ=="],
|
||||
|
||||
"tiny-invariant": ["tiny-invariant@1.3.3", "", {}, "sha512-+FbBPE1o9QAYvviau/qC5SE3caw21q3xkvWKBtja5vgqOWIHHJ3ioaq1VPfn/Szqctz2bU/oYeKd9/z5BL+PVg=="],
|
||||
|
||||
"tinyglobby": ["tinyglobby@0.2.17", "", { "dependencies": { "fdir": "^6.5.0", "picomatch": "^4.0.4" } }, "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g=="],
|
||||
|
||||
"tlds": ["tlds@1.261.0", "", { "bin": { "tlds": "bin.js" } }, "sha512-QXqwfEl9ddlGBaRFXIvNKK6OhipSiLXuRuLJX5DErz0o0Q0rYxulWLdFryTkV5PkdZct5iMInwYEGe/eR++1AA=="],
|
||||
|
||||
"to-regex-range": ["to-regex-range@5.0.1", "", { "dependencies": { "is-number": "^7.0.0" } }, "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ=="],
|
||||
|
||||
"ts-api-utils": ["ts-api-utils@2.5.0", "", { "peerDependencies": { "typescript": ">=4.8.4" } }, "sha512-OJ/ibxhPlqrMM0UiNHJ/0CKQkoKF243/AEmplt3qpRgkW8VG7IfOS41h7V8TjITqdByHzrjcS/2si+y4lIh8NA=="],
|
||||
@@ -1103,6 +1198,8 @@
|
||||
|
||||
"typescript-eslint": ["typescript-eslint@8.59.0", "", { "dependencies": { "@typescript-eslint/eslint-plugin": "8.59.0", "@typescript-eslint/parser": "8.59.0", "@typescript-eslint/typescript-estree": "8.59.0", "@typescript-eslint/utils": "8.59.0" }, "peerDependencies": { "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-BU3ONW9X+v90EcCH9ZS6LMackcVtxRLlI3XrYyqZIwVSHIk7Qf7bFw1z0M9Q0IUxhTMZCf8piY9hTYaNEIASrw=="],
|
||||
|
||||
"uc.micro": ["uc.micro@2.1.0", "", {}, "sha512-ARDJmphmdvUk6Glw7y9DQ2bFkKBHwQHLi2lsaH6PPmz/Ka9sFOBsBluozhDltWmnv9u/cF6Rt87znRTPV+yp/A=="],
|
||||
|
||||
"ufo": ["ufo@1.6.3", "", {}, "sha512-yDJTmhydvl5lJzBmy/hyOAA0d+aqCBuwl818haVdYCRrWV84o7YyeVm4QlVHStqNrrJSTb6jKuFAVqAFsr+K3Q=="],
|
||||
|
||||
"undici-types": ["undici-types@6.21.0", "", {}, "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ=="],
|
||||
@@ -1225,8 +1322,16 @@
|
||||
|
||||
"h3-v2/srvx": ["srvx@0.11.15", "", { "bin": { "srvx": "bin/srvx.mjs" } }, "sha512-iXsux0UcOjdvs0LCMa2Ws3WwcDUozA3JN3BquNXkaFPP7TpRqgunKdEgoZ/uwb1J6xaYHfxtz9Twlh6yzwM6Tg=="],
|
||||
|
||||
"htmlparser2/entities": ["entities@7.0.1", "", {}, "sha512-TWrgLOFUQTH994YUyl1yT4uyavY5nNB5muff+RtWaqNVCAK408b5ZnnbNAUEWLTCpum9w6arT70i1XdQ4UeOPA=="],
|
||||
|
||||
"imapflow/iconv-lite": ["iconv-lite@0.7.3", "", { "dependencies": { "safer-buffer": ">= 2.1.2 < 3.0.0" } }, "sha512-IKXpvIzjnC9XTAUbVBcMfGS0EPaIXtW6v+zr+RRp+hqULEpo0owZax6wyRwPOJbWbzjYspQwusTsfVr0ifh4uQ=="],
|
||||
|
||||
"libmime/iconv-lite": ["iconv-lite@0.7.3", "", { "dependencies": { "safer-buffer": ">= 2.1.2 < 3.0.0" } }, "sha512-IKXpvIzjnC9XTAUbVBcMfGS0EPaIXtW6v+zr+RRp+hqULEpo0owZax6wyRwPOJbWbzjYspQwusTsfVr0ifh4uQ=="],
|
||||
|
||||
"lovable-tagger/tailwindcss": ["tailwindcss@3.4.19", "", { "dependencies": { "@alloc/quick-lru": "^5.2.0", "arg": "^5.0.2", "chokidar": "^3.6.0", "didyoumean": "^1.2.2", "dlv": "^1.1.3", "fast-glob": "^3.3.2", "glob-parent": "^6.0.2", "is-glob": "^4.0.3", "jiti": "^1.21.7", "lilconfig": "^3.1.3", "micromatch": "^4.0.8", "normalize-path": "^3.0.0", "object-hash": "^3.0.0", "picocolors": "^1.1.1", "postcss": "^8.4.47", "postcss-import": "^15.1.0", "postcss-js": "^4.0.1", "postcss-load-config": "^4.0.2 || ^5.0 || ^6.0", "postcss-nested": "^6.2.0", "postcss-selector-parser": "^6.1.2", "resolve": "^1.22.8", "sucrase": "^3.35.0" }, "bin": { "tailwind": "lib/cli.js", "tailwindcss": "lib/cli.js" } }, "sha512-3ofp+LL8E+pK/JuPLPggVAIaEuhvIz4qNcf3nA1Xn2o/7fb7s/TYpHhwGDv1ZU3PkBluUVaF8PyCHcm48cKLWQ=="],
|
||||
|
||||
"mailparser/iconv-lite": ["iconv-lite@0.7.3", "", { "dependencies": { "safer-buffer": ">= 2.1.2 < 3.0.0" } }, "sha512-IKXpvIzjnC9XTAUbVBcMfGS0EPaIXtW6v+zr+RRp+hqULEpo0owZax6wyRwPOJbWbzjYspQwusTsfVr0ifh4uQ=="],
|
||||
|
||||
"micromatch/picomatch": ["picomatch@2.3.2", "", {}, "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA=="],
|
||||
|
||||
"prop-types/react-is": ["react-is@16.13.1", "", {}, "sha512-24e6ynE2H+OKt4kqsOvNd8kBpV65zoxbA4BVsEOB3ARVWQki/DHzaUoC5KuON/BiccDaCCTZBuOcfZs70kR8bQ=="],
|
||||
@@ -1235,6 +1340,8 @@
|
||||
|
||||
"sucrase/tinyglobby": ["tinyglobby@0.2.16", "", { "dependencies": { "fdir": "^6.5.0", "picomatch": "^4.0.4" } }, "sha512-pn99VhoACYR8nFHhxqix+uvsbXineAasWm5ojXoN8xEwK5Kd3/TrhNn1wByuD52UxWRLy8pu+kRMniEi6Eq9Zg=="],
|
||||
|
||||
"thread-stream/real-require": ["real-require@1.0.0", "", {}, "sha512-P4nbQYQfePJxRSmY+v/KINxVucm4NF3p3s7pJveMTtom52FR4YGltUQLB8idDXwDDWW+eYrWDFbuzUnjoWHF7g=="],
|
||||
|
||||
"tsx/esbuild": ["esbuild@0.27.7", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.27.7", "@esbuild/android-arm": "0.27.7", "@esbuild/android-arm64": "0.27.7", "@esbuild/android-x64": "0.27.7", "@esbuild/darwin-arm64": "0.27.7", "@esbuild/darwin-x64": "0.27.7", "@esbuild/freebsd-arm64": "0.27.7", "@esbuild/freebsd-x64": "0.27.7", "@esbuild/linux-arm": "0.27.7", "@esbuild/linux-arm64": "0.27.7", "@esbuild/linux-ia32": "0.27.7", "@esbuild/linux-loong64": "0.27.7", "@esbuild/linux-mips64el": "0.27.7", "@esbuild/linux-ppc64": "0.27.7", "@esbuild/linux-riscv64": "0.27.7", "@esbuild/linux-s390x": "0.27.7", "@esbuild/linux-x64": "0.27.7", "@esbuild/netbsd-arm64": "0.27.7", "@esbuild/netbsd-x64": "0.27.7", "@esbuild/openbsd-arm64": "0.27.7", "@esbuild/openbsd-x64": "0.27.7", "@esbuild/openharmony-arm64": "0.27.7", "@esbuild/sunos-x64": "0.27.7", "@esbuild/win32-arm64": "0.27.7", "@esbuild/win32-ia32": "0.27.7", "@esbuild/win32-x64": "0.27.7" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-IxpibTjyVnmrIQo5aqNpCgoACA/dTKLTlhMHihVHhdkxKyPO1uBBthumT0rdHmcsk9uMonIWS0m4FljWzILh3w=="],
|
||||
|
||||
"vite/rolldown": ["rolldown@1.0.3", "", { "dependencies": { "@oxc-project/types": "=0.133.0", "@rolldown/pluginutils": "^1.0.0" }, "optionalDependencies": { "@rolldown/binding-android-arm64": "1.0.3", "@rolldown/binding-darwin-arm64": "1.0.3", "@rolldown/binding-darwin-x64": "1.0.3", "@rolldown/binding-freebsd-x64": "1.0.3", "@rolldown/binding-linux-arm-gnueabihf": "1.0.3", "@rolldown/binding-linux-arm64-gnu": "1.0.3", "@rolldown/binding-linux-arm64-musl": "1.0.3", "@rolldown/binding-linux-ppc64-gnu": "1.0.3", "@rolldown/binding-linux-s390x-gnu": "1.0.3", "@rolldown/binding-linux-x64-gnu": "1.0.3", "@rolldown/binding-linux-x64-musl": "1.0.3", "@rolldown/binding-openharmony-arm64": "1.0.3", "@rolldown/binding-wasm32-wasi": "1.0.3", "@rolldown/binding-win32-arm64-msvc": "1.0.3", "@rolldown/binding-win32-x64-msvc": "1.0.3" }, "bin": { "rolldown": "./bin/cli.mjs" } }, "sha512-i00lAJ2ks1BYr7rjNjKC7BcqAS7nVfiT3QX1SI5aY+AFHblCmaUf9OE9dbdzDvW6dJxbi2ZCZiy9v3CcwOiX3g=="],
|
||||
|
||||
@@ -50,8 +50,11 @@
|
||||
"cmdk": "^1.1.1",
|
||||
"date-fns": "^4.1.0",
|
||||
"embla-carousel-react": "^8.6.0",
|
||||
"imapflow": "^1.5.0",
|
||||
"input-otp": "^1.4.2",
|
||||
"lucide-react": "^0.575.0",
|
||||
"mailparser": "^3.9.14",
|
||||
"nodemailer": "^9.0.3",
|
||||
"react": "^19.2.0",
|
||||
"react-day-picker": "^9.14.0",
|
||||
"react-dom": "^19.2.0",
|
||||
@@ -69,7 +72,9 @@
|
||||
"devDependencies": {
|
||||
"@eslint/js": "^9.32.0",
|
||||
"@lovable.dev/vite-tanstack-config": "2.6.4",
|
||||
"@types/mailparser": "^3.4.6",
|
||||
"@types/node": "^22.16.5",
|
||||
"@types/nodemailer": "^8.0.1",
|
||||
"@types/react": "^19.2.0",
|
||||
"@types/react-dom": "^19.2.0",
|
||||
"@vitejs/plugin-react": "^5.2.0",
|
||||
|
||||
@@ -531,6 +531,42 @@ export type Database = {
|
||||
},
|
||||
]
|
||||
}
|
||||
mail_server_settings: {
|
||||
Row: {
|
||||
id: boolean
|
||||
imap_host: string
|
||||
imap_port: number
|
||||
imap_secure: boolean
|
||||
smtp_host: string
|
||||
smtp_port: number
|
||||
smtp_secure: boolean
|
||||
updated_at: string
|
||||
updated_by: string | null
|
||||
}
|
||||
Insert: {
|
||||
id?: boolean
|
||||
imap_host: string
|
||||
imap_port?: number
|
||||
imap_secure?: boolean
|
||||
smtp_host: string
|
||||
smtp_port?: number
|
||||
smtp_secure?: boolean
|
||||
updated_at?: string
|
||||
updated_by?: string | null
|
||||
}
|
||||
Update: {
|
||||
id?: boolean
|
||||
imap_host?: string
|
||||
imap_port?: number
|
||||
imap_secure?: boolean
|
||||
smtp_host?: string
|
||||
smtp_port?: number
|
||||
smtp_secure?: boolean
|
||||
updated_at?: string
|
||||
updated_by?: string | null
|
||||
}
|
||||
Relationships: []
|
||||
}
|
||||
message_threads: {
|
||||
Row: {
|
||||
created_at: string
|
||||
@@ -1298,6 +1334,42 @@ export type Database = {
|
||||
},
|
||||
]
|
||||
}
|
||||
user_mailboxes: {
|
||||
Row: {
|
||||
created_at: string
|
||||
created_by: string | null
|
||||
email: string
|
||||
last_verified_at: string | null
|
||||
secret_ciphertext: string
|
||||
secret_iv: string
|
||||
secret_tag: string
|
||||
updated_at: string
|
||||
user_id: string
|
||||
}
|
||||
Insert: {
|
||||
created_at?: string
|
||||
created_by?: string | null
|
||||
email: string
|
||||
last_verified_at?: string | null
|
||||
secret_ciphertext: string
|
||||
secret_iv: string
|
||||
secret_tag: string
|
||||
updated_at?: string
|
||||
user_id: string
|
||||
}
|
||||
Update: {
|
||||
created_at?: string
|
||||
created_by?: string | null
|
||||
email?: string
|
||||
last_verified_at?: string | null
|
||||
secret_ciphertext?: string
|
||||
secret_iv?: string
|
||||
secret_tag?: string
|
||||
updated_at?: string
|
||||
user_id?: string
|
||||
}
|
||||
Relationships: []
|
||||
}
|
||||
user_roles: {
|
||||
Row: {
|
||||
created_at: string
|
||||
|
||||
@@ -0,0 +1,55 @@
|
||||
// Sealing for mailbox passwords. Server-only: never import from a route or a
|
||||
// *.functions.ts top level, both of which ship to the client bundle.
|
||||
//
|
||||
// AES-256-GCM so the stored value is both encrypted and tamper-evident — a
|
||||
// modified ciphertext fails the auth tag rather than decrypting to garbage that
|
||||
// then gets sent to an IMAP server.
|
||||
import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
|
||||
|
||||
export type Sealed = { ciphertext: string; iv: string; tag: string };
|
||||
|
||||
const KEY_ENV = "MAIL_CRED_KEY";
|
||||
|
||||
// 32 bytes, supplied base64 or hex. Generate with:
|
||||
// openssl rand -base64 32
|
||||
function key(): Buffer {
|
||||
const raw = process.env[KEY_ENV];
|
||||
if (!raw) {
|
||||
throw new Error(
|
||||
`${KEY_ENV} is not set. Add a 32-byte key to .env.secret (openssl rand -base64 32) before using mail.`,
|
||||
);
|
||||
}
|
||||
const buf = /^[0-9a-fA-F]{64}$/.test(raw.trim())
|
||||
? Buffer.from(raw.trim(), "hex")
|
||||
: Buffer.from(raw.trim(), "base64");
|
||||
if (buf.length !== 32) {
|
||||
throw new Error(`${KEY_ENV} must decode to exactly 32 bytes (got ${buf.length}).`);
|
||||
}
|
||||
return buf;
|
||||
}
|
||||
|
||||
export function seal(plaintext: string): Sealed {
|
||||
const iv = randomBytes(12); // 96-bit nonce, the GCM standard
|
||||
const c = createCipheriv("aes-256-gcm", key(), iv);
|
||||
const ct = Buffer.concat([c.update(plaintext, "utf8"), c.final()]);
|
||||
return {
|
||||
ciphertext: ct.toString("base64"),
|
||||
iv: iv.toString("base64"),
|
||||
tag: c.getAuthTag().toString("base64"),
|
||||
};
|
||||
}
|
||||
|
||||
export function open(s: Sealed): string {
|
||||
const d = createDecipheriv("aes-256-gcm", key(), Buffer.from(s.iv, "base64"));
|
||||
d.setAuthTag(Buffer.from(s.tag, "base64"));
|
||||
return Buffer.concat([d.update(Buffer.from(s.ciphertext, "base64")), d.final()]).toString("utf8");
|
||||
}
|
||||
|
||||
export function mailKeyConfigured(): boolean {
|
||||
try {
|
||||
key();
|
||||
return true;
|
||||
} catch {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,430 @@
|
||||
// Embedded mail. IMAP and SMTP are raw TCP protocols, so every one of these
|
||||
// runs server-side; the browser only ever sees parsed results.
|
||||
//
|
||||
// This file ships to the client bundle, so imapflow / nodemailer / mailparser /
|
||||
// the crypto helpers are imported *inside* handlers, never at the top level.
|
||||
import { createServerFn } from "@tanstack/react-start";
|
||||
import { requireSupabaseAuth } from "@/integrations/supabase/auth-middleware";
|
||||
|
||||
export type MailSettings = {
|
||||
imap_host: string;
|
||||
imap_port: number;
|
||||
imap_secure: boolean;
|
||||
smtp_host: string;
|
||||
smtp_port: number;
|
||||
smtp_secure: boolean;
|
||||
};
|
||||
|
||||
export type MailboxSummary = {
|
||||
user_id: string;
|
||||
email: string;
|
||||
full_name: string | null;
|
||||
last_verified_at: string | null;
|
||||
};
|
||||
|
||||
export type MessageHeader = {
|
||||
uid: number;
|
||||
subject: string;
|
||||
from: string;
|
||||
to: string;
|
||||
date: string | null;
|
||||
seen: boolean;
|
||||
flagged: boolean;
|
||||
hasAttachments: boolean;
|
||||
};
|
||||
|
||||
export type MessageBody = {
|
||||
uid: number;
|
||||
subject: string;
|
||||
from: string;
|
||||
to: string;
|
||||
cc: string;
|
||||
date: string | null;
|
||||
text: string;
|
||||
html: string | null;
|
||||
messageId: string | null;
|
||||
references: string | null;
|
||||
attachments: { filename: string; size: number; contentType: string }[];
|
||||
};
|
||||
|
||||
const callerId = (context: unknown) => (context as { userId: string }).userId;
|
||||
|
||||
async function assertAdmin(uid: string) {
|
||||
const { supabaseAdmin } = await import("@/integrations/supabase/client.server");
|
||||
const { data } = await supabaseAdmin
|
||||
.from("user_roles")
|
||||
.select("role")
|
||||
.eq("user_id", uid)
|
||||
.eq("role", "admin")
|
||||
.maybeSingle();
|
||||
if (!data) throw new Error("Only admins can manage mail settings.");
|
||||
}
|
||||
|
||||
async function loadSettings(): Promise<MailSettings> {
|
||||
const { supabaseAdmin } = await import("@/integrations/supabase/client.server");
|
||||
const { data } = await supabaseAdmin.from("mail_server_settings").select("*").maybeSingle();
|
||||
if (!data) throw new Error("Mail server is not configured yet. An admin must set it up first.");
|
||||
return data as MailSettings;
|
||||
}
|
||||
|
||||
// Resolves the caller's own mailbox credentials. Nothing here is ever returned
|
||||
// to the client — only used to open a connection.
|
||||
async function credentialsFor(userId: string) {
|
||||
const { supabaseAdmin } = await import("@/integrations/supabase/client.server");
|
||||
const { open } = await import("@/lib/mail-crypto.server");
|
||||
const { data } = await supabaseAdmin
|
||||
.from("user_mailboxes")
|
||||
.select("email, secret_ciphertext, secret_iv, secret_tag")
|
||||
.eq("user_id", userId)
|
||||
.maybeSingle();
|
||||
if (!data) throw new Error("You do not have a mailbox yet. Ask an administrator to set one up.");
|
||||
const settings = await loadSettings();
|
||||
return {
|
||||
settings,
|
||||
email: data.email,
|
||||
password: open({
|
||||
ciphertext: data.secret_ciphertext,
|
||||
iv: data.secret_iv,
|
||||
tag: data.secret_tag,
|
||||
}),
|
||||
};
|
||||
}
|
||||
|
||||
async function withImap<T>(
|
||||
userId: string,
|
||||
fn: (client: import("imapflow").ImapFlow) => Promise<T>,
|
||||
): Promise<T> {
|
||||
const { ImapFlow } = await import("imapflow");
|
||||
const { settings, email, password } = await credentialsFor(userId);
|
||||
const client = new ImapFlow({
|
||||
host: settings.imap_host,
|
||||
port: settings.imap_port,
|
||||
secure: settings.imap_secure,
|
||||
auth: { user: email, pass: password },
|
||||
logger: false,
|
||||
// Fail fast rather than hanging a request behind a dead mail host.
|
||||
socketTimeout: 20_000,
|
||||
greetingTimeout: 10_000,
|
||||
});
|
||||
await client.connect();
|
||||
try {
|
||||
return await fn(client);
|
||||
} finally {
|
||||
await client.logout().catch(() => client.close());
|
||||
}
|
||||
}
|
||||
|
||||
const addr = (a: unknown): string => {
|
||||
const list = (a as { address?: string; name?: string }[] | undefined) ?? [];
|
||||
return list.map((x) => (x.name ? `${x.name} <${x.address}>` : (x.address ?? ""))).join(", ");
|
||||
};
|
||||
|
||||
// ── Admin: setup ────────────────────────────────────────────────────────────
|
||||
export const getMailSetup = createServerFn({ method: "POST" })
|
||||
.middleware([requireSupabaseAuth])
|
||||
.handler(async ({ context }) => {
|
||||
const uid = callerId(context);
|
||||
await assertAdmin(uid);
|
||||
const { supabaseAdmin } = await import("@/integrations/supabase/client.server");
|
||||
const { mailKeyConfigured } = await import("@/lib/mail-crypto.server");
|
||||
|
||||
const { data: settings } = await supabaseAdmin
|
||||
.from("mail_server_settings")
|
||||
.select("*")
|
||||
.maybeSingle();
|
||||
const { data: boxes } = await supabaseAdmin
|
||||
.from("user_mailboxes")
|
||||
.select("user_id, email, last_verified_at");
|
||||
const ids = (boxes ?? []).map((b) => b.user_id);
|
||||
const { data: profs } = ids.length
|
||||
? await supabaseAdmin.from("profiles").select("id, full_name").in("id", ids)
|
||||
: { data: [] as { id: string; full_name: string | null }[] };
|
||||
const nameOf = Object.fromEntries((profs ?? []).map((p) => [p.id, p.full_name]));
|
||||
|
||||
// Staff eligible for a mailbox. Students are deliberately excluded from this
|
||||
// rollout; widening it is a policy decision, not a code change.
|
||||
const { data: staffRoles } = await supabaseAdmin
|
||||
.from("user_roles")
|
||||
.select("user_id, role")
|
||||
.in("role", ["admin", "teacher"]);
|
||||
const staffIds = [...new Set((staffRoles ?? []).map((r) => r.user_id))];
|
||||
const { data: staffProfiles } = staffIds.length
|
||||
? await supabaseAdmin.from("profiles").select("id, full_name, email").in("id", staffIds)
|
||||
: { data: [] as { id: string; full_name: string | null; email: string | null }[] };
|
||||
|
||||
return {
|
||||
settings: (settings ?? null) as MailSettings | null,
|
||||
keyConfigured: mailKeyConfigured(),
|
||||
mailboxes: (boxes ?? []).map((b) => ({
|
||||
user_id: b.user_id,
|
||||
email: b.email,
|
||||
full_name: nameOf[b.user_id] ?? null,
|
||||
last_verified_at: b.last_verified_at,
|
||||
})) as MailboxSummary[],
|
||||
staff: (staffProfiles ?? []) as {
|
||||
id: string;
|
||||
full_name: string | null;
|
||||
email: string | null;
|
||||
}[],
|
||||
};
|
||||
});
|
||||
|
||||
export const saveMailSettings = createServerFn({ method: "POST" })
|
||||
.middleware([requireSupabaseAuth])
|
||||
.validator((d: MailSettings) => d)
|
||||
.handler(async ({ data, context }) => {
|
||||
const uid = callerId(context);
|
||||
await assertAdmin(uid);
|
||||
const { supabaseAdmin } = await import("@/integrations/supabase/client.server");
|
||||
const { error } = await supabaseAdmin.from("mail_server_settings").upsert(
|
||||
{
|
||||
id: true,
|
||||
imap_host: data.imap_host.trim(),
|
||||
imap_port: Number(data.imap_port),
|
||||
imap_secure: !!data.imap_secure,
|
||||
smtp_host: data.smtp_host.trim(),
|
||||
smtp_port: Number(data.smtp_port),
|
||||
smtp_secure: !!data.smtp_secure,
|
||||
updated_by: uid,
|
||||
},
|
||||
{ onConflict: "id" },
|
||||
);
|
||||
if (error) throw new Error(error.message);
|
||||
return { ok: true };
|
||||
});
|
||||
|
||||
// Provisioning verifies the credentials against the live IMAP server before
|
||||
// storing them, so a typo surfaces here instead of as a broken inbox later.
|
||||
export const setUserMailbox = createServerFn({ method: "POST" })
|
||||
.middleware([requireSupabaseAuth])
|
||||
.validator((d: { userId: string; email: string; password: string }) => d)
|
||||
.handler(async ({ data, context }) => {
|
||||
const uid = callerId(context);
|
||||
await assertAdmin(uid);
|
||||
if (!data.email.trim() || !data.password)
|
||||
throw new Error("Email and password are both required.");
|
||||
|
||||
const settings = await loadSettings();
|
||||
const { ImapFlow } = await import("imapflow");
|
||||
const probe = new ImapFlow({
|
||||
host: settings.imap_host,
|
||||
port: settings.imap_port,
|
||||
secure: settings.imap_secure,
|
||||
auth: { user: data.email.trim(), pass: data.password },
|
||||
logger: false,
|
||||
socketTimeout: 20_000,
|
||||
greetingTimeout: 10_000,
|
||||
});
|
||||
try {
|
||||
await probe.connect();
|
||||
await probe.logout();
|
||||
} catch (e) {
|
||||
throw new Error(`IMAP login failed: ${(e as Error).message}`);
|
||||
}
|
||||
|
||||
const { supabaseAdmin } = await import("@/integrations/supabase/client.server");
|
||||
const { seal } = await import("@/lib/mail-crypto.server");
|
||||
const s = seal(data.password);
|
||||
const { error } = await supabaseAdmin.from("user_mailboxes").upsert(
|
||||
{
|
||||
user_id: data.userId,
|
||||
email: data.email.trim(),
|
||||
secret_ciphertext: s.ciphertext,
|
||||
secret_iv: s.iv,
|
||||
secret_tag: s.tag,
|
||||
last_verified_at: new Date().toISOString(),
|
||||
created_by: uid,
|
||||
},
|
||||
{ onConflict: "user_id" },
|
||||
);
|
||||
if (error) throw new Error(error.message);
|
||||
return { ok: true };
|
||||
});
|
||||
|
||||
export const removeUserMailbox = createServerFn({ method: "POST" })
|
||||
.middleware([requireSupabaseAuth])
|
||||
.validator((d: { userId: string }) => d)
|
||||
.handler(async ({ data, context }) => {
|
||||
const uid = callerId(context);
|
||||
await assertAdmin(uid);
|
||||
const { supabaseAdmin } = await import("@/integrations/supabase/client.server");
|
||||
const { error } = await supabaseAdmin
|
||||
.from("user_mailboxes")
|
||||
.delete()
|
||||
.eq("user_id", data.userId);
|
||||
if (error) throw new Error(error.message);
|
||||
return { ok: true };
|
||||
});
|
||||
|
||||
// ── Own mailbox ─────────────────────────────────────────────────────────────
|
||||
export const myMailboxStatus = createServerFn({ method: "POST" })
|
||||
.middleware([requireSupabaseAuth])
|
||||
.handler(async ({ context }) => {
|
||||
const { supabaseAdmin } = await import("@/integrations/supabase/client.server");
|
||||
const { data: box } = await supabaseAdmin
|
||||
.from("user_mailboxes")
|
||||
.select("email")
|
||||
.eq("user_id", callerId(context))
|
||||
.maybeSingle();
|
||||
const { data: settings } = await supabaseAdmin
|
||||
.from("mail_server_settings")
|
||||
.select("id")
|
||||
.maybeSingle();
|
||||
return { email: box?.email ?? null, serverConfigured: !!settings };
|
||||
});
|
||||
|
||||
export const listFolders = createServerFn({ method: "POST" })
|
||||
.middleware([requireSupabaseAuth])
|
||||
.handler(async ({ context }) =>
|
||||
withImap(callerId(context), async (client) => {
|
||||
const list = await client.list();
|
||||
return list
|
||||
.filter((f) => !f.flags.has("\\Noselect"))
|
||||
.map((f) => ({ path: f.path, name: f.name, specialUse: f.specialUse ?? null }));
|
||||
}),
|
||||
);
|
||||
|
||||
export const listMessages = createServerFn({ method: "POST" })
|
||||
.middleware([requireSupabaseAuth])
|
||||
.validator((d: { folder?: string; limit?: number }) => d)
|
||||
.handler(async ({ data, context }) =>
|
||||
withImap(callerId(context), async (client) => {
|
||||
const folder = data.folder || "INBOX";
|
||||
const limit = Math.min(Math.max(data.limit ?? 40, 1), 100);
|
||||
const lock = await client.getMailboxLock(folder);
|
||||
try {
|
||||
const total = typeof client.mailbox === "object" ? client.mailbox.exists : 0;
|
||||
if (!total) return { folder, total: 0, messages: [] as MessageHeader[] };
|
||||
// Newest `limit` by sequence number, then reversed for display.
|
||||
const start = Math.max(1, total - limit + 1);
|
||||
const out: MessageHeader[] = [];
|
||||
for await (const m of client.fetch(`${start}:${total}`, {
|
||||
uid: true,
|
||||
envelope: true,
|
||||
flags: true,
|
||||
bodyStructure: true,
|
||||
})) {
|
||||
const bs = m.bodyStructure as { childNodes?: { disposition?: string }[] } | undefined;
|
||||
out.push({
|
||||
uid: m.uid,
|
||||
subject: m.envelope?.subject ?? "(no subject)",
|
||||
from: addr(m.envelope?.from),
|
||||
to: addr(m.envelope?.to),
|
||||
date: m.envelope?.date ? new Date(m.envelope.date).toISOString() : null,
|
||||
seen: m.flags?.has("\\Seen") ?? false,
|
||||
flagged: m.flags?.has("\\Flagged") ?? false,
|
||||
hasAttachments: !!bs?.childNodes?.some((c) => c.disposition === "attachment"),
|
||||
});
|
||||
}
|
||||
return { folder, total, messages: out.reverse() };
|
||||
} finally {
|
||||
lock.release();
|
||||
}
|
||||
}),
|
||||
);
|
||||
|
||||
export const getMessage = createServerFn({ method: "POST" })
|
||||
.middleware([requireSupabaseAuth])
|
||||
.validator((d: { folder: string; uid: number }) => d)
|
||||
.handler(async ({ data, context }) =>
|
||||
withImap(callerId(context), async (client) => {
|
||||
const lock = await client.getMailboxLock(data.folder || "INBOX");
|
||||
try {
|
||||
const msg = await client.fetchOne(String(data.uid), { source: true }, { uid: true });
|
||||
if (!msg || !msg.source) throw new Error("Message not found.");
|
||||
const { simpleParser } = await import("mailparser");
|
||||
const p = await simpleParser(msg.source);
|
||||
// Opening a message marks it read, matching every other mail client.
|
||||
await client.messageFlagsAdd(String(data.uid), ["\\Seen"], { uid: true }).catch(() => {});
|
||||
return {
|
||||
uid: data.uid,
|
||||
subject: p.subject ?? "(no subject)",
|
||||
from: p.from?.text ?? "",
|
||||
to: Array.isArray(p.to) ? p.to.map((t) => t.text).join(", ") : (p.to?.text ?? ""),
|
||||
cc: Array.isArray(p.cc) ? p.cc.map((t) => t.text).join(", ") : (p.cc?.text ?? ""),
|
||||
date: p.date ? p.date.toISOString() : null,
|
||||
text: p.text ?? "",
|
||||
html: typeof p.html === "string" ? p.html : null,
|
||||
messageId: p.messageId ?? null,
|
||||
references: Array.isArray(p.references) ? p.references.join(" ") : (p.references ?? null),
|
||||
attachments: (p.attachments ?? []).map((a) => ({
|
||||
filename: a.filename ?? "attachment",
|
||||
size: a.size ?? 0,
|
||||
contentType: a.contentType ?? "application/octet-stream",
|
||||
})),
|
||||
} as MessageBody;
|
||||
} finally {
|
||||
lock.release();
|
||||
}
|
||||
}),
|
||||
);
|
||||
|
||||
export const getAttachment = createServerFn({ method: "POST" })
|
||||
.middleware([requireSupabaseAuth])
|
||||
.validator((d: { folder: string; uid: number; filename: string }) => d)
|
||||
.handler(async ({ data, context }) =>
|
||||
withImap(callerId(context), async (client) => {
|
||||
const lock = await client.getMailboxLock(data.folder || "INBOX");
|
||||
try {
|
||||
const msg = await client.fetchOne(String(data.uid), { source: true }, { uid: true });
|
||||
if (!msg || !msg.source) throw new Error("Message not found.");
|
||||
const { simpleParser } = await import("mailparser");
|
||||
const p = await simpleParser(msg.source);
|
||||
const found = (p.attachments ?? []).find(
|
||||
(a) => (a.filename ?? "attachment") === data.filename,
|
||||
);
|
||||
if (!found) throw new Error("Attachment not found.");
|
||||
return {
|
||||
filename: data.filename,
|
||||
contentType: found.contentType ?? "application/octet-stream",
|
||||
base64: Buffer.from(found.content).toString("base64"),
|
||||
};
|
||||
} finally {
|
||||
lock.release();
|
||||
}
|
||||
}),
|
||||
);
|
||||
|
||||
export const sendMail = createServerFn({ method: "POST" })
|
||||
.middleware([requireSupabaseAuth])
|
||||
.validator(
|
||||
(d: {
|
||||
to: string;
|
||||
cc?: string;
|
||||
subject: string;
|
||||
body: string;
|
||||
inReplyTo?: string | null;
|
||||
references?: string | null;
|
||||
}) => d,
|
||||
)
|
||||
.handler(async ({ data, context }) => {
|
||||
const uid = callerId(context);
|
||||
const { settings, email, password } = await credentialsFor(uid);
|
||||
if (!data.to.trim()) throw new Error("At least one recipient is required.");
|
||||
|
||||
const nodemailer = await import("nodemailer");
|
||||
const transport = nodemailer.createTransport({
|
||||
host: settings.smtp_host,
|
||||
port: settings.smtp_port,
|
||||
secure: settings.smtp_secure, // false = STARTTLS on 587
|
||||
auth: { user: email, pass: password },
|
||||
connectionTimeout: 20_000,
|
||||
});
|
||||
|
||||
const info = await transport.sendMail({
|
||||
from: email,
|
||||
to: data.to,
|
||||
cc: data.cc || undefined,
|
||||
subject: data.subject,
|
||||
text: data.body,
|
||||
// Threading headers so replies land in the original conversation.
|
||||
inReplyTo: data.inReplyTo || undefined,
|
||||
references: data.references || undefined,
|
||||
});
|
||||
|
||||
// Deliberately not appending a copy to the Sent folder. Hosted providers
|
||||
// (Migadu, Zoho, Google, Fastmail) file SMTP-submitted mail into Sent
|
||||
// themselves, so appending would show every sent message twice. If the
|
||||
// chosen provider turns out not to file sent mail, add an IMAP append here.
|
||||
return { ok: true, messageId: info.messageId };
|
||||
});
|
||||
@@ -17,6 +17,7 @@ import { Route as AuthenticatedStudentsRouteImport } from './routes/_authenticat
|
||||
import { Route as AuthenticatedReportsRouteImport } from './routes/_authenticated/reports'
|
||||
import { Route as AuthenticatedPlansRouteImport } from './routes/_authenticated/plans'
|
||||
import { Route as AuthenticatedMessagesRouteImport } from './routes/_authenticated/messages'
|
||||
import { Route as AuthenticatedMailRouteImport } from './routes/_authenticated/mail'
|
||||
import { Route as AuthenticatedLedgerRouteImport } from './routes/_authenticated/ledger'
|
||||
import { Route as AuthenticatedFormsRouteImport } from './routes/_authenticated/forms'
|
||||
import { Route as AuthenticatedDashboardRouteImport } from './routes/_authenticated/dashboard'
|
||||
@@ -70,6 +71,11 @@ const AuthenticatedMessagesRoute = AuthenticatedMessagesRouteImport.update({
|
||||
path: '/messages',
|
||||
getParentRoute: () => AuthenticatedRouteRoute,
|
||||
} as any)
|
||||
const AuthenticatedMailRoute = AuthenticatedMailRouteImport.update({
|
||||
id: '/mail',
|
||||
path: '/mail',
|
||||
getParentRoute: () => AuthenticatedRouteRoute,
|
||||
} as any)
|
||||
const AuthenticatedLedgerRoute = AuthenticatedLedgerRouteImport.update({
|
||||
id: '/ledger',
|
||||
path: '/ledger',
|
||||
@@ -149,6 +155,7 @@ export interface FileRoutesByFullPath {
|
||||
'/dashboard': typeof AuthenticatedDashboardRoute
|
||||
'/forms': typeof AuthenticatedFormsRoute
|
||||
'/ledger': typeof AuthenticatedLedgerRoute
|
||||
'/mail': typeof AuthenticatedMailRoute
|
||||
'/messages': typeof AuthenticatedMessagesRoute
|
||||
'/plans': typeof AuthenticatedPlansRoute
|
||||
'/reports': typeof AuthenticatedReportsRoute
|
||||
@@ -170,6 +177,7 @@ export interface FileRoutesByTo {
|
||||
'/dashboard': typeof AuthenticatedDashboardRoute
|
||||
'/forms': typeof AuthenticatedFormsRoute
|
||||
'/ledger': typeof AuthenticatedLedgerRoute
|
||||
'/mail': typeof AuthenticatedMailRoute
|
||||
'/messages': typeof AuthenticatedMessagesRoute
|
||||
'/plans': typeof AuthenticatedPlansRoute
|
||||
'/reports': typeof AuthenticatedReportsRoute
|
||||
@@ -193,6 +201,7 @@ export interface FileRoutesById {
|
||||
'/_authenticated/dashboard': typeof AuthenticatedDashboardRoute
|
||||
'/_authenticated/forms': typeof AuthenticatedFormsRoute
|
||||
'/_authenticated/ledger': typeof AuthenticatedLedgerRoute
|
||||
'/_authenticated/mail': typeof AuthenticatedMailRoute
|
||||
'/_authenticated/messages': typeof AuthenticatedMessagesRoute
|
||||
'/_authenticated/plans': typeof AuthenticatedPlansRoute
|
||||
'/_authenticated/reports': typeof AuthenticatedReportsRoute
|
||||
@@ -217,6 +226,7 @@ export interface FileRouteTypes {
|
||||
| '/dashboard'
|
||||
| '/forms'
|
||||
| '/ledger'
|
||||
| '/mail'
|
||||
| '/messages'
|
||||
| '/plans'
|
||||
| '/reports'
|
||||
@@ -238,6 +248,7 @@ export interface FileRouteTypes {
|
||||
| '/dashboard'
|
||||
| '/forms'
|
||||
| '/ledger'
|
||||
| '/mail'
|
||||
| '/messages'
|
||||
| '/plans'
|
||||
| '/reports'
|
||||
@@ -260,6 +271,7 @@ export interface FileRouteTypes {
|
||||
| '/_authenticated/dashboard'
|
||||
| '/_authenticated/forms'
|
||||
| '/_authenticated/ledger'
|
||||
| '/_authenticated/mail'
|
||||
| '/_authenticated/messages'
|
||||
| '/_authenticated/plans'
|
||||
| '/_authenticated/reports'
|
||||
@@ -338,6 +350,13 @@ declare module '@tanstack/react-router' {
|
||||
preLoaderRoute: typeof AuthenticatedMessagesRouteImport
|
||||
parentRoute: typeof AuthenticatedRouteRoute
|
||||
}
|
||||
'/_authenticated/mail': {
|
||||
id: '/_authenticated/mail'
|
||||
path: '/mail'
|
||||
fullPath: '/mail'
|
||||
preLoaderRoute: typeof AuthenticatedMailRouteImport
|
||||
parentRoute: typeof AuthenticatedRouteRoute
|
||||
}
|
||||
'/_authenticated/ledger': {
|
||||
id: '/_authenticated/ledger'
|
||||
path: '/ledger'
|
||||
@@ -470,6 +489,7 @@ interface AuthenticatedRouteRouteChildren {
|
||||
AuthenticatedDashboardRoute: typeof AuthenticatedDashboardRoute
|
||||
AuthenticatedFormsRoute: typeof AuthenticatedFormsRoute
|
||||
AuthenticatedLedgerRoute: typeof AuthenticatedLedgerRoute
|
||||
AuthenticatedMailRoute: typeof AuthenticatedMailRoute
|
||||
AuthenticatedMessagesRoute: typeof AuthenticatedMessagesRoute
|
||||
AuthenticatedPlansRoute: typeof AuthenticatedPlansRoute
|
||||
AuthenticatedReportsRoute: typeof AuthenticatedReportsRoute
|
||||
@@ -485,6 +505,7 @@ const AuthenticatedRouteRouteChildren: AuthenticatedRouteRouteChildren = {
|
||||
AuthenticatedDashboardRoute: AuthenticatedDashboardRoute,
|
||||
AuthenticatedFormsRoute: AuthenticatedFormsRoute,
|
||||
AuthenticatedLedgerRoute: AuthenticatedLedgerRoute,
|
||||
AuthenticatedMailRoute: AuthenticatedMailRoute,
|
||||
AuthenticatedMessagesRoute: AuthenticatedMessagesRoute,
|
||||
AuthenticatedPlansRoute: AuthenticatedPlansRoute,
|
||||
AuthenticatedReportsRoute: AuthenticatedReportsRoute,
|
||||
|
||||
@@ -0,0 +1,689 @@
|
||||
import { createFileRoute } from "@tanstack/react-router";
|
||||
import { useQuery, useMutation, useQueryClient } from "@tanstack/react-query";
|
||||
import { useAuth } from "@/hooks/use-auth";
|
||||
import { Button } from "@/components/ui/button";
|
||||
import { Input } from "@/components/ui/input";
|
||||
import { Label } from "@/components/ui/label";
|
||||
import { Textarea } from "@/components/ui/textarea";
|
||||
import { Switch } from "@/components/ui/switch";
|
||||
import { Badge } from "@/components/ui/badge";
|
||||
import {
|
||||
Dialog,
|
||||
DialogContent,
|
||||
DialogHeader,
|
||||
DialogTitle,
|
||||
DialogDescription,
|
||||
} from "@/components/ui/dialog";
|
||||
import {
|
||||
Select,
|
||||
SelectContent,
|
||||
SelectItem,
|
||||
SelectTrigger,
|
||||
SelectValue,
|
||||
} from "@/components/ui/select";
|
||||
import {
|
||||
Mail,
|
||||
Inbox,
|
||||
Loader2,
|
||||
Paperclip,
|
||||
RefreshCw,
|
||||
Reply,
|
||||
Send,
|
||||
Settings,
|
||||
Trash2,
|
||||
AlertTriangle,
|
||||
} from "lucide-react";
|
||||
import { useState } from "react";
|
||||
import { toast } from "sonner";
|
||||
import {
|
||||
getMailSetup,
|
||||
getAttachment,
|
||||
getMessage,
|
||||
listFolders,
|
||||
listMessages,
|
||||
myMailboxStatus,
|
||||
removeUserMailbox,
|
||||
saveMailSettings,
|
||||
sendMail,
|
||||
setUserMailbox,
|
||||
type MailSettings,
|
||||
} from "@/lib/mail.functions";
|
||||
|
||||
export const Route = createFileRoute("/_authenticated/mail")({
|
||||
head: () => ({ meta: [{ title: "Mail — School Portal" }] }),
|
||||
component: MailPage,
|
||||
});
|
||||
|
||||
const fmt = (iso: string | null) =>
|
||||
iso ? new Date(iso).toLocaleString(undefined, { dateStyle: "medium", timeStyle: "short" }) : "—";
|
||||
|
||||
function MailPage() {
|
||||
const { roles } = useAuth();
|
||||
const isAdmin = roles.includes("admin");
|
||||
const qc = useQueryClient();
|
||||
const [folder, setFolder] = useState("INBOX");
|
||||
const [openUid, setOpenUid] = useState<number | null>(null);
|
||||
const [composing, setComposing] = useState<null | {
|
||||
to: string;
|
||||
subject: string;
|
||||
inReplyTo: string | null;
|
||||
references: string | null;
|
||||
}>(null);
|
||||
const [setupOpen, setSetupOpen] = useState(false);
|
||||
|
||||
const status = useQuery({
|
||||
queryKey: ["mail-status"],
|
||||
queryFn: () => myMailboxStatus({}),
|
||||
});
|
||||
|
||||
const folders = useQuery({
|
||||
queryKey: ["mail-folders"],
|
||||
enabled: !!status.data?.email,
|
||||
queryFn: () => listFolders({}),
|
||||
retry: false,
|
||||
});
|
||||
|
||||
const messages = useQuery({
|
||||
queryKey: ["mail-messages", folder],
|
||||
enabled: !!status.data?.email,
|
||||
queryFn: () => listMessages({ data: { folder, limit: 40 } }),
|
||||
retry: false,
|
||||
});
|
||||
|
||||
if (status.isLoading) {
|
||||
return (
|
||||
<div className="p-8 flex items-center gap-2 text-sm text-muted-foreground">
|
||||
<Loader2 className="h-4 w-4 animate-spin" /> Loading mail…
|
||||
</div>
|
||||
);
|
||||
}
|
||||
|
||||
// Nothing set up yet: tell the admin what to do, and tell everyone else who to ask.
|
||||
if (!status.data?.email) {
|
||||
return (
|
||||
<div className="p-8 max-w-2xl">
|
||||
<h1 className="text-2xl font-semibold flex items-center gap-2">
|
||||
<Mail className="h-6 w-6 text-primary" /> Mail
|
||||
</h1>
|
||||
<div className="bg-card border rounded-lg p-6 mt-6 space-y-3">
|
||||
{!status.data?.serverConfigured ? (
|
||||
<>
|
||||
<div className="font-medium">The mail server isn't configured yet.</div>
|
||||
<p className="text-sm text-muted-foreground">
|
||||
{isAdmin
|
||||
? "Enter your provider's IMAP and SMTP details, then give each staff member their mailbox login."
|
||||
: "An administrator needs to set up the school mail server before you can use this page."}
|
||||
</p>
|
||||
</>
|
||||
) : (
|
||||
<>
|
||||
<div className="font-medium">You don't have a mailbox yet.</div>
|
||||
<p className="text-sm text-muted-foreground">
|
||||
The mail server is configured, but no mailbox has been assigned to your account.
|
||||
{isAdmin ? " Assign one below." : " Ask an administrator to set one up."}
|
||||
</p>
|
||||
</>
|
||||
)}
|
||||
{isAdmin && (
|
||||
<Button onClick={() => setSetupOpen(true)}>
|
||||
<Settings className="h-4 w-4 mr-1" /> Mail setup
|
||||
</Button>
|
||||
)}
|
||||
</div>
|
||||
{setupOpen && (
|
||||
<MailSetupDialog
|
||||
onClose={() => {
|
||||
setSetupOpen(false);
|
||||
qc.invalidateQueries({ queryKey: ["mail-status"] });
|
||||
}}
|
||||
/>
|
||||
)}
|
||||
</div>
|
||||
);
|
||||
}
|
||||
|
||||
const err = (messages.error ?? folders.error) as Error | undefined;
|
||||
|
||||
return (
|
||||
<div className="p-6 md:p-8">
|
||||
<div className="flex items-center justify-between flex-wrap gap-2">
|
||||
<div>
|
||||
<h1 className="text-2xl font-semibold flex items-center gap-2">
|
||||
<Mail className="h-6 w-6 text-primary" /> Mail
|
||||
</h1>
|
||||
<p className="text-muted-foreground text-sm mt-1">{status.data.email}</p>
|
||||
</div>
|
||||
<div className="flex gap-2">
|
||||
<Button
|
||||
size="sm"
|
||||
variant="outline"
|
||||
onClick={() => qc.invalidateQueries({ queryKey: ["mail-messages", folder] })}
|
||||
disabled={messages.isFetching}
|
||||
>
|
||||
<RefreshCw className={`h-4 w-4 mr-1 ${messages.isFetching ? "animate-spin" : ""}`} />{" "}
|
||||
Refresh
|
||||
</Button>
|
||||
<Button
|
||||
size="sm"
|
||||
onClick={() => setComposing({ to: "", subject: "", inReplyTo: null, references: null })}
|
||||
>
|
||||
<Send className="h-4 w-4 mr-1" /> Compose
|
||||
</Button>
|
||||
{isAdmin && (
|
||||
<Button size="sm" variant="ghost" onClick={() => setSetupOpen(true)}>
|
||||
<Settings className="h-4 w-4" />
|
||||
</Button>
|
||||
)}
|
||||
</div>
|
||||
</div>
|
||||
|
||||
{err && (
|
||||
<div className="mt-4 border rounded-md p-3 flex items-start gap-2 text-sm">
|
||||
<AlertTriangle className="h-4 w-4 text-destructive shrink-0 mt-0.5" />
|
||||
<div>
|
||||
<div className="font-medium">Couldn't reach the mail server</div>
|
||||
<div className="text-muted-foreground text-xs mt-0.5">{err.message}</div>
|
||||
</div>
|
||||
</div>
|
||||
)}
|
||||
|
||||
<div className="grid grid-cols-1 md:grid-cols-[200px_1fr] gap-4 mt-6">
|
||||
<div className="bg-card border rounded-lg p-2 h-fit">
|
||||
{(folders.data ?? [{ path: "INBOX", name: "Inbox", specialUse: null }]).map((f) => (
|
||||
<button
|
||||
key={f.path}
|
||||
onClick={() => {
|
||||
setFolder(f.path);
|
||||
setOpenUid(null);
|
||||
}}
|
||||
className={`w-full text-left px-3 py-1.5 rounded-md text-sm flex items-center gap-2 ${
|
||||
folder === f.path ? "bg-primary text-primary-foreground" : "hover:bg-muted"
|
||||
}`}
|
||||
>
|
||||
<Inbox className="h-3.5 w-3.5 shrink-0" />
|
||||
<span className="truncate">{f.name}</span>
|
||||
</button>
|
||||
))}
|
||||
</div>
|
||||
|
||||
<div className="min-w-0">
|
||||
{messages.isLoading ? (
|
||||
<div className="bg-card border rounded-lg p-6 flex items-center gap-2 text-sm text-muted-foreground">
|
||||
<Loader2 className="h-4 w-4 animate-spin" /> Loading messages…
|
||||
</div>
|
||||
) : (messages.data?.messages ?? []).length === 0 ? (
|
||||
<div className="bg-card border rounded-lg p-6 text-sm text-muted-foreground">
|
||||
No messages in this folder.
|
||||
</div>
|
||||
) : (
|
||||
<div className="bg-card border rounded-lg divide-y">
|
||||
{(messages.data?.messages ?? []).map((m) => (
|
||||
<button
|
||||
key={m.uid}
|
||||
onClick={() => setOpenUid(m.uid)}
|
||||
className="w-full text-left p-3 hover:bg-muted/40 flex gap-3 items-start"
|
||||
>
|
||||
<div className="min-w-0 flex-1">
|
||||
<div className="flex items-center gap-2">
|
||||
<span className={`truncate text-sm ${m.seen ? "" : "font-semibold"}`}>
|
||||
{m.from || "(unknown sender)"}
|
||||
</span>
|
||||
{!m.seen && (
|
||||
<Badge variant="default" className="h-4 px-1 text-[10px]">
|
||||
New
|
||||
</Badge>
|
||||
)}
|
||||
{m.hasAttachments && (
|
||||
<Paperclip className="h-3 w-3 text-muted-foreground shrink-0" />
|
||||
)}
|
||||
</div>
|
||||
<div className={`truncate text-sm ${m.seen ? "text-muted-foreground" : ""}`}>
|
||||
{m.subject}
|
||||
</div>
|
||||
</div>
|
||||
<span className="text-xs text-muted-foreground shrink-0">{fmt(m.date)}</span>
|
||||
</button>
|
||||
))}
|
||||
</div>
|
||||
)}
|
||||
{messages.data ? (
|
||||
<p className="text-xs text-muted-foreground mt-2">
|
||||
Showing {messages.data.messages.length} of {messages.data.total} in{" "}
|
||||
{messages.data.folder}.
|
||||
</p>
|
||||
) : null}
|
||||
</div>
|
||||
</div>
|
||||
|
||||
{openUid !== null && (
|
||||
<MessageDialog
|
||||
folder={folder}
|
||||
uid={openUid}
|
||||
onClose={() => {
|
||||
setOpenUid(null);
|
||||
qc.invalidateQueries({ queryKey: ["mail-messages", folder] });
|
||||
}}
|
||||
onReply={(c) => {
|
||||
setOpenUid(null);
|
||||
setComposing(c);
|
||||
}}
|
||||
/>
|
||||
)}
|
||||
{composing && <ComposeDialog initial={composing} onClose={() => setComposing(null)} />}
|
||||
{setupOpen && (
|
||||
<MailSetupDialog
|
||||
onClose={() => {
|
||||
setSetupOpen(false);
|
||||
qc.invalidateQueries({ queryKey: ["mail-status"] });
|
||||
}}
|
||||
/>
|
||||
)}
|
||||
</div>
|
||||
);
|
||||
}
|
||||
|
||||
function MessageDialog({
|
||||
folder,
|
||||
uid,
|
||||
onClose,
|
||||
onReply,
|
||||
}: {
|
||||
folder: string;
|
||||
uid: number;
|
||||
onClose: () => void;
|
||||
onReply: (c: {
|
||||
to: string;
|
||||
subject: string;
|
||||
inReplyTo: string | null;
|
||||
references: string | null;
|
||||
}) => void;
|
||||
}) {
|
||||
const { data, isLoading, error } = useQuery({
|
||||
queryKey: ["mail-message", folder, uid],
|
||||
queryFn: () => getMessage({ data: { folder, uid } }),
|
||||
retry: false,
|
||||
});
|
||||
|
||||
const download = async (filename: string) => {
|
||||
try {
|
||||
const a = await getAttachment({ data: { folder, uid, filename } });
|
||||
const bytes = Uint8Array.from(atob(a.base64), (ch) => ch.charCodeAt(0));
|
||||
const url = URL.createObjectURL(new Blob([bytes], { type: a.contentType }));
|
||||
const el = document.createElement("a");
|
||||
el.href = url;
|
||||
el.download = a.filename;
|
||||
el.click();
|
||||
URL.revokeObjectURL(url);
|
||||
} catch (e) {
|
||||
toast.error((e as Error).message);
|
||||
}
|
||||
};
|
||||
|
||||
return (
|
||||
<Dialog open onOpenChange={(o) => !o && onClose()}>
|
||||
<DialogContent className="max-w-3xl max-h-[85vh] overflow-auto">
|
||||
<DialogHeader>
|
||||
<DialogTitle className="pr-8">{data?.subject ?? "Message"}</DialogTitle>
|
||||
</DialogHeader>
|
||||
{isLoading && (
|
||||
<div className="flex items-center gap-2 text-sm text-muted-foreground">
|
||||
<Loader2 className="h-4 w-4 animate-spin" /> Loading…
|
||||
</div>
|
||||
)}
|
||||
{error && <p className="text-sm text-destructive">{(error as Error).message}</p>}
|
||||
{data && (
|
||||
<div className="space-y-3">
|
||||
<div className="text-sm space-y-0.5 border-b pb-2">
|
||||
<div>
|
||||
<span className="text-muted-foreground">From:</span> {data.from}
|
||||
</div>
|
||||
<div>
|
||||
<span className="text-muted-foreground">To:</span> {data.to}
|
||||
</div>
|
||||
{data.cc && (
|
||||
<div>
|
||||
<span className="text-muted-foreground">Cc:</span> {data.cc}
|
||||
</div>
|
||||
)}
|
||||
<div className="text-xs text-muted-foreground">{fmt(data.date)}</div>
|
||||
</div>
|
||||
|
||||
{data.attachments.length > 0 && (
|
||||
<div className="flex flex-wrap gap-2">
|
||||
{data.attachments.map((a) => (
|
||||
<Button
|
||||
key={a.filename}
|
||||
size="sm"
|
||||
variant="outline"
|
||||
onClick={() => download(a.filename)}
|
||||
>
|
||||
<Paperclip className="h-3.5 w-3.5 mr-1" /> {a.filename}
|
||||
<span className="text-xs text-muted-foreground ml-1">
|
||||
{(a.size / 1024).toFixed(0)} KB
|
||||
</span>
|
||||
</Button>
|
||||
))}
|
||||
</div>
|
||||
)}
|
||||
|
||||
{/* Remote HTML is deliberately not rendered — an <iframe> or
|
||||
dangerouslySetInnerHTML here would execute sender-controlled
|
||||
markup and leak read receipts via tracking pixels. */}
|
||||
<pre className="text-sm whitespace-pre-wrap break-words font-sans">
|
||||
{data.text || "(no plain-text body)"}
|
||||
</pre>
|
||||
{!data.text && data.html && (
|
||||
<p className="text-xs text-muted-foreground">
|
||||
This message is HTML-only. It is shown as text for safety.
|
||||
</p>
|
||||
)}
|
||||
|
||||
<Button
|
||||
size="sm"
|
||||
onClick={() =>
|
||||
onReply({
|
||||
to: data.from,
|
||||
subject: data.subject.startsWith("Re:") ? data.subject : `Re: ${data.subject}`,
|
||||
inReplyTo: data.messageId,
|
||||
references: [data.references, data.messageId].filter(Boolean).join(" ") || null,
|
||||
})
|
||||
}
|
||||
>
|
||||
<Reply className="h-4 w-4 mr-1" /> Reply
|
||||
</Button>
|
||||
</div>
|
||||
)}
|
||||
</DialogContent>
|
||||
</Dialog>
|
||||
);
|
||||
}
|
||||
|
||||
function ComposeDialog({
|
||||
initial,
|
||||
onClose,
|
||||
}: {
|
||||
initial: { to: string; subject: string; inReplyTo: string | null; references: string | null };
|
||||
onClose: () => void;
|
||||
}) {
|
||||
const [to, setTo] = useState(initial.to);
|
||||
const [cc, setCc] = useState("");
|
||||
const [subject, setSubject] = useState(initial.subject);
|
||||
const [body, setBody] = useState("");
|
||||
|
||||
const send = useMutation({
|
||||
mutationFn: () =>
|
||||
sendMail({
|
||||
data: {
|
||||
to,
|
||||
cc,
|
||||
subject,
|
||||
body,
|
||||
inReplyTo: initial.inReplyTo,
|
||||
references: initial.references,
|
||||
},
|
||||
}),
|
||||
onSuccess: () => {
|
||||
toast.success("Message sent");
|
||||
onClose();
|
||||
},
|
||||
onError: (e: Error) => toast.error(e.message),
|
||||
});
|
||||
|
||||
return (
|
||||
<Dialog open onOpenChange={(o) => !o && onClose()}>
|
||||
<DialogContent className="max-w-2xl">
|
||||
<DialogHeader>
|
||||
<DialogTitle>{initial.inReplyTo ? "Reply" : "New message"}</DialogTitle>
|
||||
</DialogHeader>
|
||||
<div className="space-y-3">
|
||||
<div>
|
||||
<Label className="text-xs">To</Label>
|
||||
<Input
|
||||
value={to}
|
||||
onChange={(e) => setTo(e.target.value)}
|
||||
placeholder="name@example.com"
|
||||
/>
|
||||
</div>
|
||||
<div>
|
||||
<Label className="text-xs">Cc</Label>
|
||||
<Input value={cc} onChange={(e) => setCc(e.target.value)} />
|
||||
</div>
|
||||
<div>
|
||||
<Label className="text-xs">Subject</Label>
|
||||
<Input value={subject} onChange={(e) => setSubject(e.target.value)} />
|
||||
</div>
|
||||
<div>
|
||||
<Label className="text-xs">Message</Label>
|
||||
<Textarea rows={10} value={body} onChange={(e) => setBody(e.target.value)} />
|
||||
</div>
|
||||
<div className="flex gap-2">
|
||||
<Button onClick={() => send.mutate()} disabled={!to || send.isPending}>
|
||||
{send.isPending ? "Sending…" : "Send"}
|
||||
</Button>
|
||||
<Button variant="ghost" onClick={onClose}>
|
||||
Cancel
|
||||
</Button>
|
||||
</div>
|
||||
</div>
|
||||
</DialogContent>
|
||||
</Dialog>
|
||||
);
|
||||
}
|
||||
|
||||
// ── Admin setup: server details + per-user mailbox provisioning ──────────────
|
||||
function MailSetupDialog({ onClose }: { onClose: () => void }) {
|
||||
const qc = useQueryClient();
|
||||
const setup = useQuery({
|
||||
queryKey: ["mail-setup"],
|
||||
queryFn: () => getMailSetup({}),
|
||||
retry: false,
|
||||
});
|
||||
|
||||
const [s, setS] = useState<MailSettings | null>(null);
|
||||
const current: MailSettings = s ??
|
||||
setup.data?.settings ?? {
|
||||
imap_host: "",
|
||||
imap_port: 993,
|
||||
imap_secure: true,
|
||||
smtp_host: "",
|
||||
smtp_port: 587,
|
||||
smtp_secure: false,
|
||||
};
|
||||
|
||||
const [box, setBox] = useState({ userId: "", email: "", password: "" });
|
||||
|
||||
const saveSettings = useMutation({
|
||||
mutationFn: () => saveMailSettings({ data: current }),
|
||||
onSuccess: () => {
|
||||
toast.success("Mail server saved");
|
||||
qc.invalidateQueries({ queryKey: ["mail-setup"] });
|
||||
qc.invalidateQueries({ queryKey: ["mail-status"] });
|
||||
},
|
||||
onError: (e: Error) => toast.error(e.message),
|
||||
});
|
||||
|
||||
const assign = useMutation({
|
||||
mutationFn: () => setUserMailbox({ data: box }),
|
||||
onSuccess: () => {
|
||||
toast.success("Mailbox verified and saved");
|
||||
setBox({ userId: "", email: "", password: "" });
|
||||
qc.invalidateQueries({ queryKey: ["mail-setup"] });
|
||||
qc.invalidateQueries({ queryKey: ["mail-status"] });
|
||||
},
|
||||
onError: (e: Error) => toast.error(e.message),
|
||||
});
|
||||
|
||||
const remove = useMutation({
|
||||
mutationFn: (userId: string) => removeUserMailbox({ data: { userId } }),
|
||||
onSuccess: () => {
|
||||
toast.success("Mailbox removed");
|
||||
qc.invalidateQueries({ queryKey: ["mail-setup"] });
|
||||
qc.invalidateQueries({ queryKey: ["mail-status"] });
|
||||
},
|
||||
onError: (e: Error) => toast.error(e.message),
|
||||
});
|
||||
|
||||
return (
|
||||
<Dialog open onOpenChange={(o) => !o && onClose()}>
|
||||
<DialogContent className="max-w-2xl max-h-[85vh] overflow-auto">
|
||||
<DialogHeader>
|
||||
<DialogTitle>Mail setup</DialogTitle>
|
||||
<DialogDescription>
|
||||
One mail server for the school, with a separate mailbox login per staff member.
|
||||
</DialogDescription>
|
||||
</DialogHeader>
|
||||
|
||||
{setup.error && (
|
||||
<p className="text-sm text-destructive">{(setup.error as Error).message}</p>
|
||||
)}
|
||||
|
||||
{setup.data && !setup.data.keyConfigured && (
|
||||
<div className="border rounded-md p-3 flex items-start gap-2 text-xs">
|
||||
<AlertTriangle className="h-4 w-4 text-destructive shrink-0 mt-0.5" />
|
||||
<span>
|
||||
<strong>MAIL_CRED_KEY is not set on the server.</strong> Mailbox passwords are sealed
|
||||
with it, so assigning a mailbox will fail until it exists. Generate one with{" "}
|
||||
<code>openssl rand -base64 32</code> and add it to <code>.env.secret</code>.
|
||||
</span>
|
||||
</div>
|
||||
)}
|
||||
|
||||
<div className="space-y-3">
|
||||
<div className="font-medium text-sm">Server</div>
|
||||
<div className="grid grid-cols-1 md:grid-cols-3 gap-3">
|
||||
<div className="md:col-span-2">
|
||||
<Label className="text-xs">IMAP host</Label>
|
||||
<Input
|
||||
value={current.imap_host}
|
||||
onChange={(e) => setS({ ...current, imap_host: e.target.value })}
|
||||
placeholder="imap.provider.com"
|
||||
/>
|
||||
</div>
|
||||
<div>
|
||||
<Label className="text-xs">IMAP port</Label>
|
||||
<Input
|
||||
inputMode="numeric"
|
||||
value={String(current.imap_port)}
|
||||
onChange={(e) => setS({ ...current, imap_port: Number(e.target.value) || 0 })}
|
||||
/>
|
||||
</div>
|
||||
</div>
|
||||
<div className="flex items-center justify-between max-w-sm">
|
||||
<Label className="text-xs">IMAP uses TLS on connect (port 993)</Label>
|
||||
<Switch
|
||||
checked={current.imap_secure}
|
||||
onCheckedChange={(v) => setS({ ...current, imap_secure: v })}
|
||||
/>
|
||||
</div>
|
||||
|
||||
<div className="grid grid-cols-1 md:grid-cols-3 gap-3">
|
||||
<div className="md:col-span-2">
|
||||
<Label className="text-xs">SMTP host</Label>
|
||||
<Input
|
||||
value={current.smtp_host}
|
||||
onChange={(e) => setS({ ...current, smtp_host: e.target.value })}
|
||||
placeholder="smtp.provider.com"
|
||||
/>
|
||||
</div>
|
||||
<div>
|
||||
<Label className="text-xs">SMTP port</Label>
|
||||
<Input
|
||||
inputMode="numeric"
|
||||
value={String(current.smtp_port)}
|
||||
onChange={(e) => setS({ ...current, smtp_port: Number(e.target.value) || 0 })}
|
||||
/>
|
||||
</div>
|
||||
</div>
|
||||
<div className="flex items-center justify-between max-w-sm">
|
||||
<Label className="text-xs">SMTP uses TLS on connect (465; off = STARTTLS on 587)</Label>
|
||||
<Switch
|
||||
checked={current.smtp_secure}
|
||||
onCheckedChange={(v) => setS({ ...current, smtp_secure: v })}
|
||||
/>
|
||||
</div>
|
||||
<Button
|
||||
size="sm"
|
||||
onClick={() => saveSettings.mutate()}
|
||||
disabled={!current.imap_host || !current.smtp_host || saveSettings.isPending}
|
||||
>
|
||||
{saveSettings.isPending ? "Saving…" : "Save server settings"}
|
||||
</Button>
|
||||
</div>
|
||||
|
||||
<div className="border-t pt-4 space-y-3">
|
||||
<div className="font-medium text-sm">Mailboxes</div>
|
||||
<div className="border rounded-lg divide-y">
|
||||
{(setup.data?.mailboxes ?? []).map((m) => (
|
||||
<div key={m.user_id} className="p-3 flex items-center justify-between gap-3">
|
||||
<div className="min-w-0">
|
||||
<div className="text-sm font-medium truncate">{m.full_name || m.email}</div>
|
||||
<div className="text-xs text-muted-foreground truncate">
|
||||
{m.email}
|
||||
{m.last_verified_at ? ` · verified ${fmt(m.last_verified_at)}` : ""}
|
||||
</div>
|
||||
</div>
|
||||
<Button
|
||||
size="sm"
|
||||
variant="ghost"
|
||||
onClick={() => {
|
||||
if (
|
||||
confirm(
|
||||
`Remove the mailbox for ${m.email}? Their mail is not deleted — the portal just stops connecting to it.`,
|
||||
)
|
||||
)
|
||||
remove.mutate(m.user_id);
|
||||
}}
|
||||
>
|
||||
<Trash2 className="h-4 w-4" />
|
||||
</Button>
|
||||
</div>
|
||||
))}
|
||||
{(setup.data?.mailboxes ?? []).length === 0 && (
|
||||
<div className="p-3 text-sm text-muted-foreground">No mailboxes assigned yet.</div>
|
||||
)}
|
||||
</div>
|
||||
|
||||
<div className="border rounded-md p-3 space-y-2">
|
||||
<div className="text-sm font-medium">Assign a mailbox</div>
|
||||
<div className="grid grid-cols-1 md:grid-cols-3 gap-2">
|
||||
<Select value={box.userId} onValueChange={(v) => setBox({ ...box, userId: v })}>
|
||||
<SelectTrigger>
|
||||
<SelectValue placeholder="Staff member" />
|
||||
</SelectTrigger>
|
||||
<SelectContent>
|
||||
{(setup.data?.staff ?? []).map((u) => (
|
||||
<SelectItem key={u.id} value={u.id}>
|
||||
{u.full_name || u.email}
|
||||
</SelectItem>
|
||||
))}
|
||||
</SelectContent>
|
||||
</Select>
|
||||
<Input
|
||||
placeholder="mailbox@school.org"
|
||||
value={box.email}
|
||||
onChange={(e) => setBox({ ...box, email: e.target.value })}
|
||||
/>
|
||||
<Input
|
||||
type="password"
|
||||
placeholder="Mailbox password"
|
||||
value={box.password}
|
||||
onChange={(e) => setBox({ ...box, password: e.target.value })}
|
||||
/>
|
||||
</div>
|
||||
<p className="text-xs text-muted-foreground">
|
||||
The password is checked against the IMAP server before it is stored, then sealed with
|
||||
AES-256-GCM. It is never sent back to any browser, including yours.
|
||||
</p>
|
||||
<Button
|
||||
size="sm"
|
||||
onClick={() => assign.mutate()}
|
||||
disabled={!box.userId || !box.email || !box.password || assign.isPending}
|
||||
>
|
||||
{assign.isPending ? "Verifying…" : "Verify & save mailbox"}
|
||||
</Button>
|
||||
</div>
|
||||
</div>
|
||||
</DialogContent>
|
||||
</Dialog>
|
||||
);
|
||||
}
|
||||
@@ -4,7 +4,7 @@ import { supabase } from "@/integrations/supabase/client";
|
||||
import { Button } from "@/components/ui/button";
|
||||
import {
|
||||
GraduationCap, LayoutDashboard, Users, ClipboardCheck, Receipt,
|
||||
MessageSquare, FileText, CalendarDays, Settings, LogOut, Loader2, BookOpen, ClipboardList, Printer
|
||||
MessageSquare, FileText, CalendarDays, Settings, LogOut, Loader2, BookOpen, ClipboardList, Printer, Mail
|
||||
} from "lucide-react";
|
||||
import { useEffect } from "react";
|
||||
|
||||
@@ -38,6 +38,7 @@ function ProtectedLayout() {
|
||||
{ to: "/reports", label: "Reports", icon: Printer, show: isAdmin || roles.includes("teacher") },
|
||||
{ to: "/ledger", label: "Tuition", icon: Receipt, show: true },
|
||||
{ to: "/messages", label: "Messages", icon: MessageSquare, show: true },
|
||||
{ to: "/mail", label: "Mail", icon: Mail, show: isAdmin || roles.includes("teacher") },
|
||||
{ to: "/forms", label: "Forms", icon: FileText, show: true },
|
||||
{ to: "/calendar", label: "Calendar", icon: CalendarDays, show: true },
|
||||
{ to: "/admin", label: "Admin", icon: Settings, show: isAdmin },
|
||||
|
||||
@@ -0,0 +1,63 @@
|
||||
-- Embedded mail: one shared IMAP/SMTP server configured by admins, with a
|
||||
-- per-user mailbox login.
|
||||
--
|
||||
-- Threat model drives the shape here. A mailbox password grants full read and
|
||||
-- send access to someone's email, so:
|
||||
--
|
||||
-- * user_mailboxes has RLS enabled and NO policies at all. Nothing reachable
|
||||
-- from a browser can read it — not even the mailbox owner, and not admins.
|
||||
-- Every access goes through server functions using the service role, the
|
||||
-- same pattern intake_tokens uses.
|
||||
-- * The password is never stored as plaintext. It is sealed with AES-256-GCM
|
||||
-- using MAIL_CRED_KEY from .env.secret, so a database dump alone is not
|
||||
-- enough to open anyone's mail.
|
||||
-- * The IMAP/SMTP *host* settings are not secret, so admins may read those
|
||||
-- directly to populate the setup form.
|
||||
|
||||
CREATE TABLE IF NOT EXISTS public.mail_server_settings (
|
||||
-- Single-row table: the school has one mail server.
|
||||
id BOOLEAN PRIMARY KEY DEFAULT TRUE CHECK (id = TRUE),
|
||||
imap_host TEXT NOT NULL,
|
||||
imap_port INT NOT NULL DEFAULT 993,
|
||||
imap_secure BOOLEAN NOT NULL DEFAULT TRUE, -- implicit TLS on connect
|
||||
smtp_host TEXT NOT NULL,
|
||||
smtp_port INT NOT NULL DEFAULT 587,
|
||||
smtp_secure BOOLEAN NOT NULL DEFAULT FALSE, -- false = STARTTLS upgrade
|
||||
updated_by UUID REFERENCES auth.users(id),
|
||||
updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
);
|
||||
GRANT SELECT ON public.mail_server_settings TO authenticated;
|
||||
GRANT ALL ON public.mail_server_settings TO service_role;
|
||||
ALTER TABLE public.mail_server_settings ENABLE ROW LEVEL SECURITY;
|
||||
|
||||
-- Host/port are operational config, not secrets. Admins read them to fill in
|
||||
-- the setup form; writes go through a server function so they can be validated
|
||||
-- against a live login first.
|
||||
CREATE POLICY "mail settings admin read" ON public.mail_server_settings FOR SELECT TO authenticated
|
||||
USING (public.current_user_has_role('admin'));
|
||||
|
||||
CREATE TABLE IF NOT EXISTS public.user_mailboxes (
|
||||
user_id UUID PRIMARY KEY REFERENCES auth.users(id) ON DELETE CASCADE,
|
||||
email TEXT NOT NULL,
|
||||
-- AES-256-GCM sealed mailbox password. Never returned to any client.
|
||||
secret_ciphertext TEXT NOT NULL,
|
||||
secret_iv TEXT NOT NULL,
|
||||
secret_tag TEXT NOT NULL,
|
||||
last_verified_at TIMESTAMPTZ,
|
||||
created_by UUID REFERENCES auth.users(id),
|
||||
created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
||||
updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
);
|
||||
CREATE INDEX IF NOT EXISTS idx_user_mailboxes_email ON public.user_mailboxes(email);
|
||||
GRANT ALL ON public.user_mailboxes TO service_role;
|
||||
ALTER TABLE public.user_mailboxes ENABLE ROW LEVEL SECURITY;
|
||||
-- Deliberately no policies and no grant to `authenticated`: credentials must
|
||||
-- never be reachable from the browser under any role.
|
||||
|
||||
DROP TRIGGER IF EXISTS trg_mail_settings_upd ON public.mail_server_settings;
|
||||
CREATE TRIGGER trg_mail_settings_upd BEFORE UPDATE ON public.mail_server_settings
|
||||
FOR EACH ROW EXECUTE FUNCTION public.set_updated_at();
|
||||
|
||||
DROP TRIGGER IF EXISTS trg_user_mailboxes_upd ON public.user_mailboxes;
|
||||
CREATE TRIGGER trg_user_mailboxes_upd BEFORE UPDATE ON public.user_mailboxes
|
||||
FOR EACH ROW EXECUTE FUNCTION public.set_updated_at();
|
||||
Reference in New Issue
Block a user