Initial commit: webmail client (M0/M1)

Three-pane webmail client. - Backend: FastAPI + async SQLAlchemy + arq worker (Postgres/Redis), IMAP/SMTP sync, threading, search, drafts/outbox with undo, attachments, 2FA. - Frontend: React 18 + Vite + TypeScript + TanStack Query + Tailwind; three-pane UI with rich-text composer, light/dark themes, resizable panels. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-17 23:20:34 +02:00
commit a5ec0d21cb
174 changed files with 22239 additions and 0 deletions
@@ -0,0 +1,163 @@
+"""Compose endpoints: drafts + send + undo (SPEC §9.1)."""
+
+from __future__ import annotations
+
+import uuid
+from datetime import timedelta
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, File, Query, UploadFile
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.api.errors import raise_api_error
+from app.api.schemas import AttachmentOut
+from app.config import get_settings
+from app.db import get_session
+from app.identity.deps import CurrentUser, require_csrf
+from app.indexer import blobstore
+from app.models import ComposeAttachment, Draft
+from app.outbox.schemas import DraftIn, DraftOut, SendRequest, SendResponse
+from app.outbox.service import DraftError, cancel_outbox, create_outbox, upsert_draft
+from app.queue import get_arq_pool
+
+router = APIRouter(tags=["compose"], dependencies=[Depends(require_csrf)])
+
+DbSession = Annotated[AsyncSession, Depends(get_session)]
+
+MAX_ATTACHMENT_BYTES = 25 * 1024 * 1024  # 25 MB per file (compose Attach limit)
+
+
+def _att_out(att: ComposeAttachment) -> AttachmentOut:
+    return AttachmentOut(
+        id=att.id, filename=att.filename, mime_type=att.mime_type, size_bytes=att.size_bytes
+    )
+
+
+@router.post("/attachments", response_model=AttachmentOut)
+async def upload_attachment(
+    user: CurrentUser, db: DbSession, file: UploadFile = File(...)
+) -> AttachmentOut:
+    """Store a file for an outgoing message (≤ 25 MB) and return its metadata."""
+    data = await file.read()
+    if not data:
+        raise_api_error(400, "empty_file", "the file is empty")
+    if len(data) > MAX_ATTACHMENT_BYTES:
+        raise_api_error(413, "too_large", "attachment exceeds the 25 MB limit")
+    sha = blobstore.store(user.id, data)
+    att = ComposeAttachment(
+        user_id=user.id,
+        filename=file.filename or "attachment",
+        mime_type=file.content_type or "application/octet-stream",
+        size_bytes=len(data),
+        blob_sha256=sha,
+    )
+    db.add(att)
+    await db.commit()
+    return _att_out(att)
+
+
+@router.get("/attachments", response_model=list[AttachmentOut])
+async def list_compose_attachments(
+    user: CurrentUser, db: DbSession, ids: str = Query("")
+) -> list[AttachmentOut]:
+    """Resolve metadata for the given compose-attachment ids (reopening a draft)."""
+    id_list: list[uuid.UUID] = []
+    for value in ids.split(","):
+        value = value.strip()
+        if not value:
+            continue
+        try:
+            id_list.append(uuid.UUID(value))
+        except ValueError:
+            continue
+    if not id_list:
+        return []
+    rows = await db.scalars(
+        select(ComposeAttachment).where(
+            ComposeAttachment.user_id == user.id, ComposeAttachment.id.in_(id_list)
+        )
+    )
+    by_id = {r.id: r for r in rows}
+    return [_att_out(by_id[i]) for i in id_list if i in by_id]
+
+
+def _draft_out(draft: Draft) -> DraftOut:
+    return DraftOut(
+        id=draft.id,
+        account_id=draft.account_id,
+        thread_id=draft.thread_id,
+        reply_to_message_id=draft.reply_to_message_id,
+        kind=draft.kind,
+        payload=draft.payload,
+        updated_at=draft.updated_at.isoformat(),
+    )
+
+
+@router.get("/drafts", response_model=list[DraftOut])
+async def list_drafts(user: CurrentUser, db: DbSession) -> list[DraftOut]:
+    drafts = await db.scalars(
+        select(Draft).where(Draft.user_id == user.id).order_by(Draft.updated_at.desc())
+    )
+    return [_draft_out(d) for d in drafts]
+
+
+@router.post("/drafts", response_model=DraftOut)
+async def create_draft(body: DraftIn, user: CurrentUser, db: DbSession) -> DraftOut:
+    try:
+        draft = await upsert_draft(db, user_id=user.id, body=body, draft_id=None)
+    except DraftError as exc:
+        raise_api_error(400, "draft_error", str(exc))
+    await db.commit()
+    return _draft_out(draft)
+
+
+@router.put("/drafts/{draft_id}", response_model=DraftOut)
+async def update_draft(
+    draft_id: uuid.UUID, body: DraftIn, user: CurrentUser, db: DbSession
+) -> DraftOut:
+    try:
+        draft = await upsert_draft(db, user_id=user.id, body=body, draft_id=draft_id)
+    except DraftError as exc:
+        code = 404 if "not found" in str(exc) else 400
+        raise_api_error(code, "draft_error", str(exc))
+    await db.commit()
+    return _draft_out(draft)
+
+
+@router.delete("/drafts/{draft_id}")
+async def delete_draft(draft_id: uuid.UUID, user: CurrentUser, db: DbSession) -> dict[str, str]:
+    draft = await db.scalar(select(Draft).where(Draft.id == draft_id, Draft.user_id == user.id))
+    if draft is None:
+        raise_api_error(404, "not_found", "draft not found")
+    await db.delete(draft)
+    await db.commit()
+    return {"status": "deleted"}
+
+
+@router.post("/send", response_model=SendResponse)
+async def send(body: SendRequest, user: CurrentUser, db: DbSession) -> SendResponse:
+    draft = await db.scalar(
+        select(Draft).where(Draft.id == body.draft_id, Draft.user_id == user.id)
+    )
+    if draft is None:
+        raise_api_error(404, "not_found", "draft not found")
+    outbox = await create_outbox(db, user_id=user.id, draft=draft)
+    await db.commit()
+
+    pool = await get_arq_pool()
+    await pool.enqueue_job(
+        "send_job",
+        str(outbox.id),
+        _defer_by=timedelta(seconds=get_settings().undo_seconds),
+    )
+    return SendResponse(outbox_id=outbox.id, undo_until=outbox.send_after.isoformat())
+
+
+@router.post("/send/{outbox_id}/undo")
+async def undo_send(outbox_id: uuid.UUID, user: CurrentUser, db: DbSession) -> dict[str, str]:
+    ok = await cancel_outbox(db, user_id=user.id, outbox_id=outbox_id)
+    await db.commit()
+    if not ok:
+        raise_api_error(409, "undo_too_late", "the message has already left the undo window")
+    return {"status": "cancelled"}