64 lines
3.1 KiB
SQL
64 lines
3.1 KiB
SQL
-- Embedded mail: one shared IMAP/SMTP server configured by admins, with a
|
|
-- per-user mailbox login.
|
|
--
|
|
-- Threat model drives the shape here. A mailbox password grants full read and
|
|
-- send access to someone's email, so:
|
|
--
|
|
-- * user_mailboxes has RLS enabled and NO policies at all. Nothing reachable
|
|
-- from a browser can read it — not even the mailbox owner, and not admins.
|
|
-- Every access goes through server functions using the service role, the
|
|
-- same pattern intake_tokens uses.
|
|
-- * The password is never stored as plaintext. It is sealed with AES-256-GCM
|
|
-- using MAIL_CRED_KEY from .env.secret, so a database dump alone is not
|
|
-- enough to open anyone's mail.
|
|
-- * The IMAP/SMTP *host* settings are not secret, so admins may read those
|
|
-- directly to populate the setup form.
|
|
|
|
CREATE TABLE IF NOT EXISTS public.mail_server_settings (
|
|
-- Single-row table: the school has one mail server.
|
|
id BOOLEAN PRIMARY KEY DEFAULT TRUE CHECK (id = TRUE),
|
|
imap_host TEXT NOT NULL,
|
|
imap_port INT NOT NULL DEFAULT 993,
|
|
imap_secure BOOLEAN NOT NULL DEFAULT TRUE, -- implicit TLS on connect
|
|
smtp_host TEXT NOT NULL,
|
|
smtp_port INT NOT NULL DEFAULT 587,
|
|
smtp_secure BOOLEAN NOT NULL DEFAULT FALSE, -- false = STARTTLS upgrade
|
|
updated_by UUID REFERENCES auth.users(id),
|
|
updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
|
);
|
|
GRANT SELECT ON public.mail_server_settings TO authenticated;
|
|
GRANT ALL ON public.mail_server_settings TO service_role;
|
|
ALTER TABLE public.mail_server_settings ENABLE ROW LEVEL SECURITY;
|
|
|
|
-- Host/port are operational config, not secrets. Admins read them to fill in
|
|
-- the setup form; writes go through a server function so they can be validated
|
|
-- against a live login first.
|
|
CREATE POLICY "mail settings admin read" ON public.mail_server_settings FOR SELECT TO authenticated
|
|
USING (public.current_user_has_role('admin'));
|
|
|
|
CREATE TABLE IF NOT EXISTS public.user_mailboxes (
|
|
user_id UUID PRIMARY KEY REFERENCES auth.users(id) ON DELETE CASCADE,
|
|
email TEXT NOT NULL,
|
|
-- AES-256-GCM sealed mailbox password. Never returned to any client.
|
|
secret_ciphertext TEXT NOT NULL,
|
|
secret_iv TEXT NOT NULL,
|
|
secret_tag TEXT NOT NULL,
|
|
last_verified_at TIMESTAMPTZ,
|
|
created_by UUID REFERENCES auth.users(id),
|
|
created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
|
updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
|
);
|
|
CREATE INDEX IF NOT EXISTS idx_user_mailboxes_email ON public.user_mailboxes(email);
|
|
GRANT ALL ON public.user_mailboxes TO service_role;
|
|
ALTER TABLE public.user_mailboxes ENABLE ROW LEVEL SECURITY;
|
|
-- Deliberately no policies and no grant to `authenticated`: credentials must
|
|
-- never be reachable from the browser under any role.
|
|
|
|
DROP TRIGGER IF EXISTS trg_mail_settings_upd ON public.mail_server_settings;
|
|
CREATE TRIGGER trg_mail_settings_upd BEFORE UPDATE ON public.mail_server_settings
|
|
FOR EACH ROW EXECUTE FUNCTION public.set_updated_at();
|
|
|
|
DROP TRIGGER IF EXISTS trg_user_mailboxes_upd ON public.user_mailboxes;
|
|
CREATE TRIGGER trg_user_mailboxes_upd BEFORE UPDATE ON public.user_mailboxes
|
|
FOR EACH ROW EXECUTE FUNCTION public.set_updated_at();
|