Initial commit: webmail client (M0/M1)

Three-pane webmail client.
- Backend: FastAPI + async SQLAlchemy + arq worker (Postgres/Redis), IMAP/SMTP
  sync, threading, search, drafts/outbox with undo, attachments, 2FA.
- Frontend: React 18 + Vite + TypeScript + TanStack Query + Tailwind; three-pane
  UI with rich-text composer, light/dark themes, resizable panels.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
2026-07-17 23:20:34 +02:00
co-authored by Claude Opus 4.8
commit a5ec0d21cb
174 changed files with 22239 additions and 0 deletions
+2
View File
@@ -0,0 +1,2 @@
"""Mail provider abstraction (SPEC §5.1). Nothing above this package may
import IMAP/SMTP libraries — only concrete providers do."""
+111
View File
@@ -0,0 +1,111 @@
# INTERFACE VERSION: 1
"""MailProvider — the frozen provider contract (SPEC §5.1).
This signature is a frozen contract (SPEC instruction 5): implementations may
evolve, signatures may not without bumping the version comment above.
"""
from __future__ import annotations
from collections.abc import AsyncIterator
from dataclasses import dataclass
from datetime import datetime
from typing import Protocol
class ProviderError(Exception):
"""Base class for provider errors; carries a human-readable ``.detail``."""
def __init__(self, detail: str) -> None:
super().__init__(detail)
self.detail = detail
class ProviderAuthError(ProviderError):
"""Authentication failed (bad credentials / token)."""
class ProviderConnectError(ProviderError):
"""Could not connect / TLS / greeting failure."""
class ProviderNotSupported(ProviderError):
"""A capability (e.g. IDLE) is not supported by the server."""
@dataclass(frozen=True)
class RemoteMailbox:
path: str
special_use: str | None # "inbox"|"sent"|"drafts"|"trash"|"junk"|"archive"|None
uidvalidity: int
@dataclass(frozen=True)
class RemoteMessage:
uid: int
raw: bytes # full RFC822
flags: frozenset[str]
internal_date: datetime
@dataclass(frozen=True)
class FlagChange:
uid: int
flags: frozenset[str]
@dataclass(frozen=True)
class MailboxDelta:
new: list[RemoteMessage]
flag_changes: list[FlagChange]
expunged_uids: list[int]
new_uidvalidity: int | None # non-None => UIDVALIDITY changed, caller must full-resync
new_highestmodseq: int | None
class MailProvider(Protocol):
async def verify(self) -> None:
"""Raises ProviderAuthError / ProviderConnectError with a human-readable .detail."""
...
async def list_mailboxes(self) -> list[RemoteMailbox]: ...
def backfill(
self, mailbox: str, *, newest_first: bool = True, batch_size: int = 200
) -> AsyncIterator[list[RemoteMessage]]:
"""Yields batches until the mailbox is exhausted. Headers+body in one pass."""
...
async def poll(
self, mailbox: str, *, last_seen_uid: int, highestmodseq: int | None
) -> MailboxDelta:
"""One reconciliation pass. Uses QRESYNC/CONDSTORE when highestmodseq is not None,
otherwise UID SEARCH + FETCH FLAGS diff."""
...
async def idle(self, mailbox: str) -> None:
"""Blocks until the server signals change or 25 min elapse (re-issue IDLE). May raise
ProviderNotSupported => sync loop falls back to poll() every POLL_INTERVAL (default 120 s).
"""
...
async def push_flags(
self, mailbox: str, uid: int, add: frozenset[str], remove: frozenset[str]
) -> None: ...
async def move(self, uid: int, src: str, dst: str) -> int: # returns new UID
...
async def delete_messages(self, mailbox: str, uids: list[int]) -> None:
"""Permanently delete messages: set \\Deleted then EXPUNGE (SPEC §6.3)."""
...
async def append(
self, mailbox: str, raw: bytes, flags: frozenset[str]
) -> int: # Sent/Drafts upload
...
async def send(
self, raw: bytes, envelope_from: str, envelope_to: list[str]
) -> None: # SMTP submission
...
@@ -0,0 +1,7 @@
"""IMAP+SMTP provider — the only M0-M2 MailProvider implementation (SPEC §5.1)."""
from __future__ import annotations
from app.providers.imap_smtp.provider import ImapSmtpProvider, ProviderConfig
__all__ = ["ImapSmtpProvider", "ProviderConfig"]
+165
View File
@@ -0,0 +1,165 @@
"""Pure parsing helpers for IMAP responses (unit-testable, no I/O).
aioimaplib returns responses as lists of ``bytes``/``bytearray`` lines. A FETCH
with ``BODY[]`` yields, per message, a header line ending ``... {<size>}`` followed
by a ``bytearray`` literal, then a lone ``)``. LIST lines carry SPECIAL-USE flags.
"""
from __future__ import annotations
import re
from dataclasses import dataclass
from datetime import datetime
from imapclient.imap_utf7 import decode as imap_utf7_decode
# --- SPECIAL-USE mapping (SPEC §4 special_use values) -----------------------
_SPECIAL_USE_FLAGS = {
"\\sent": "sent",
"\\drafts": "drafts",
"\\trash": "trash",
"\\junk": "junk",
"\\archive": "archive",
"\\all": "archive", # Gmail "All Mail" acts as archive
}
_LIST_RE = re.compile(rb'^\(([^)]*)\)\s+(?:"([^"]*)"|NIL)\s+(.+)$')
_UID_RE = re.compile(rb"UID\s+(\d+)")
_FLAGS_RE = re.compile(rb"FLAGS\s+\(([^)]*)\)")
_INTERNALDATE_RE = re.compile(rb'INTERNALDATE\s+"([^"]+)"')
_LITERAL_RE = re.compile(rb"\{(\d+)\}\s*$")
_FETCH_HEADER_RE = re.compile(rb"^\d+\s+FETCH\s+\(", re.IGNORECASE)
@dataclass(frozen=True)
class ParsedMailbox:
path: str
special_use: str | None
@dataclass(frozen=True)
class ParsedFetch:
uid: int
flags: frozenset[str]
internal_date: datetime | None
raw: bytes | None # None when the fetch did not request the body
def _decode_mailbox_name(raw: bytes) -> str:
name = raw.strip()
if name.startswith(b'"') and name.endswith(b'"'):
name = name[1:-1]
# IMAP mailbox names are modified UTF-7 (SPEC §4: store UTF-7 decoded).
return str(imap_utf7_decode(bytes(name)))
def parse_list_line(line: bytes) -> ParsedMailbox | None:
"""Parse one LIST response line into a :class:`ParsedMailbox` (or None)."""
m = _LIST_RE.match(line.strip())
if not m:
return None
flags = m.group(1).lower().split()
name = _decode_mailbox_name(m.group(3))
special: str | None = None
for flag in flags:
mapped = _SPECIAL_USE_FLAGS.get(flag.decode("ascii", "ignore"))
if mapped:
special = mapped
break
if special is None and name.upper() == "INBOX":
special = "inbox"
return ParsedMailbox(path=name, special_use=special)
def parse_internaldate(raw: bytes | str) -> datetime | None:
"""Parse an IMAP INTERNALDATE (``d-Mon-Y H:M:S +ZZZZ``) to an aware datetime."""
text = raw.decode("ascii", "ignore") if isinstance(raw, bytes) else raw
text = text.strip()
try:
return datetime.strptime(text, "%d-%b-%Y %H:%M:%S %z")
except ValueError:
return None
def _parse_flag_token(tok: bytes) -> str:
return tok.decode("ascii", "ignore")
def parse_fetch_header(line: bytes) -> tuple[int | None, frozenset[str], datetime | None]:
"""Extract (uid, flags, internaldate) from a FETCH header line."""
uid_m = _UID_RE.search(line)
uid = int(uid_m.group(1)) if uid_m else None
flags_m = _FLAGS_RE.search(line)
if flags_m:
flags = frozenset(_parse_flag_token(t) for t in flags_m.group(1).split())
else:
flags = frozenset()
date_m = _INTERNALDATE_RE.search(line)
internal = parse_internaldate(date_m.group(1)) if date_m else None
return uid, flags, internal
def parse_fetch_lines(lines: list[bytes | bytearray]) -> list[ParsedFetch]:
"""Walk a full FETCH response, returning one :class:`ParsedFetch` per message.
Handles both metadata-only fetches (FLAGS/INTERNALDATE) and body fetches
(a ``{size}`` literal announced on the header line, body on the next line).
"""
results: list[ParsedFetch] = []
i = 0
n = len(lines)
while i < n:
line = lines[i]
if not isinstance(line, (bytes, bytearray)) or not _FETCH_HEADER_RE.match(bytes(line)):
i += 1
continue
header = bytes(line)
uid, flags, internal = parse_fetch_header(header)
raw: bytes | None = None
if _LITERAL_RE.search(header) and i + 1 < n:
body = lines[i + 1]
raw = bytes(body)
i += 2
# Skip the trailing ")" continuation line if present.
if (
i < n
and isinstance(lines[i], (bytes, bytearray))
and bytes(lines[i]).strip() == b")"
):
i += 1
else:
i += 1
if uid is not None:
results.append(ParsedFetch(uid=uid, flags=flags, internal_date=internal, raw=raw))
return results
def parse_search_uids(lines: list[bytes | bytearray]) -> list[int]:
"""Parse a UID SEARCH response's first line into a list of ints."""
if not lines:
return []
first = lines[0]
if not isinstance(first, (bytes, bytearray)):
return []
return [int(tok) for tok in bytes(first).split() if tok.isdigit()]
def parse_select_untagged(lines: list[bytes | bytearray]) -> dict[str, int]:
"""Extract UIDVALIDITY / UIDNEXT / HIGHESTMODSEQ / EXISTS from SELECT lines."""
out: dict[str, int] = {}
patterns = {
"uidvalidity": re.compile(rb"UIDVALIDITY\s+(\d+)"),
"uidnext": re.compile(rb"UIDNEXT\s+(\d+)"),
"highestmodseq": re.compile(rb"HIGHESTMODSEQ\s+(\d+)"),
"exists": re.compile(rb"^(\d+)\s+EXISTS"),
}
for line in lines:
if not isinstance(line, (bytes, bytearray)):
continue
b = bytes(line)
for key, pat in patterns.items():
m = pat.search(b)
if m:
out[key] = int(m.group(1))
return out
+312
View File
@@ -0,0 +1,312 @@
"""``ImapSmtpProvider`` — IMAP (aioimaplib) + SMTP (aiosmtplib) MailProvider.
One instance == one IMAP connection (SPEC §6.3 caps connections per account);
the sync engine creates separate instances for the IDLE loop vs. backfill/jobs.
Credentials arrive already decrypted (decryption lives only in workers /
accounts.test per SPEC §10.2).
"""
from __future__ import annotations
import asyncio
import contextlib
import re
from collections.abc import AsyncIterator
from dataclasses import dataclass
import aiosmtplib
from aioimaplib import aioimaplib
from app.providers.base import (
FlagChange,
MailboxDelta,
MailProvider,
ProviderAuthError,
ProviderConnectError,
ProviderNotSupported,
RemoteMailbox,
RemoteMessage,
)
from app.providers.imap_smtp.parsing import (
parse_fetch_lines,
parse_list_line,
parse_search_uids,
parse_select_untagged,
)
_FETCH_ITEMS = "(UID FLAGS INTERNALDATE RFC822.SIZE BODY.PEEK[])"
_IDLE_TIMEOUT = 25 * 60 # SPEC §5.1: re-issue IDLE at least every 25 min
_CONNECT_TIMEOUT = 20
_APPENDUID_RE = re.compile(rb"APPENDUID\s+\d+\s+(\d+)")
_COPYUID_RE = re.compile(rb"COPYUID\s+\d+\s+\S+\s+(\d+)")
@dataclass(frozen=True)
class ProviderConfig:
imap_host: str
imap_port: int
imap_tls: str # "ssl" | "starttls" | "plain"
smtp_host: str
smtp_port: int
smtp_tls: str # "ssl" | "starttls" | "plain"
username: str
password: str # plaintext; caller decrypts per §10.2
class ImapSmtpProvider(MailProvider):
def __init__(self, config: ProviderConfig) -> None:
self._cfg = config
self._imap: aioimaplib.IMAP4 | None = None
self._selected: str | None = None
self._uidvalidity_seen: dict[str, int] = {}
# --- connection lifecycle ------------------------------------------------
async def _connect(self) -> aioimaplib.IMAP4:
if self._imap is not None:
return self._imap
cfg = self._cfg
try:
if cfg.imap_tls == "ssl":
imap = aioimaplib.IMAP4_SSL(
host=cfg.imap_host, port=cfg.imap_port, timeout=_CONNECT_TIMEOUT
)
else:
imap = aioimaplib.IMAP4(
host=cfg.imap_host, port=cfg.imap_port, timeout=_CONNECT_TIMEOUT
)
await imap.wait_hello_from_server()
if cfg.imap_tls == "starttls":
await imap.starttls()
except (OSError, TimeoutError) as exc:
raise ProviderConnectError(f"cannot connect to {cfg.imap_host}: {exc}") from exc
resp = await imap.login(cfg.username, cfg.password)
if resp.result != "OK":
detail = (
b" ".join(resp.lines).decode("utf-8", "ignore") if resp.lines else "login failed"
)
raise ProviderAuthError(detail)
self._imap = imap
return imap
async def _select(self, mailbox: str) -> dict[str, int]:
imap = await self._connect()
resp = await imap.select(mailbox)
if resp.result != "OK":
raise ProviderConnectError(f"cannot select {mailbox!r}")
self._selected = mailbox
return parse_select_untagged(resp.lines)
async def close(self) -> None:
if self._imap is not None:
with contextlib.suppress(Exception): # best-effort teardown
await self._imap.logout()
self._imap = None
self._selected = None
# --- MailProvider protocol ----------------------------------------------
async def verify(self) -> None:
imap = await self._connect()
resp = await imap.list('""', "*")
if resp.result != "OK":
raise ProviderConnectError("LIST failed after login")
async def list_mailboxes(self) -> list[RemoteMailbox]:
imap = await self._connect()
resp = await imap.list('""', "*")
if resp.result != "OK":
raise ProviderConnectError("LIST failed")
out: list[RemoteMailbox] = []
for line in resp.lines:
if not isinstance(line, (bytes, bytearray)):
continue
parsed = parse_list_line(bytes(line))
if parsed is None:
continue
uidvalidity = await self._mailbox_uidvalidity(parsed.path)
out.append(
RemoteMailbox(
path=parsed.path, special_use=parsed.special_use, uidvalidity=uidvalidity
)
)
return out
async def _mailbox_uidvalidity(self, path: str) -> int:
imap = await self._connect()
try:
resp = await imap.status(path, "(UIDVALIDITY)")
except Exception:
return 0
if resp.result != "OK":
return 0
for line in resp.lines:
if isinstance(line, (bytes, bytearray)):
m = re.search(rb"UIDVALIDITY\s+(\d+)", bytes(line))
if m:
return int(m.group(1))
return 0
async def backfill(
self, mailbox: str, *, newest_first: bool = True, batch_size: int = 200
) -> AsyncIterator[list[RemoteMessage]]:
info = await self._select(mailbox)
self._uidvalidity_seen[mailbox] = info.get("uidvalidity", 0)
imap = await self._connect()
search = await imap.uid_search("ALL")
uids = parse_search_uids(search.lines)
uids.sort(reverse=newest_first)
for start in range(0, len(uids), batch_size):
batch = uids[start : start + batch_size]
messages = await self._fetch_messages(imap, batch)
if messages:
yield messages
async def _fetch_messages(self, imap: aioimaplib.IMAP4, uids: list[int]) -> list[RemoteMessage]:
if not uids:
return []
uid_set = ",".join(str(u) for u in uids)
resp = await imap.uid("fetch", uid_set, _FETCH_ITEMS)
if resp.result != "OK":
raise ProviderConnectError("FETCH failed")
out: list[RemoteMessage] = []
for pf in parse_fetch_lines(resp.lines):
if pf.raw is None or pf.internal_date is None:
continue
out.append(
RemoteMessage(
uid=pf.uid, raw=pf.raw, flags=pf.flags, internal_date=pf.internal_date
)
)
return out
async def poll(
self, mailbox: str, *, last_seen_uid: int, highestmodseq: int | None
) -> MailboxDelta:
info = await self._select(mailbox)
imap = await self._connect()
current_uidvalidity = info.get("uidvalidity", 0)
new_uidvalidity: int | None = None
prev = self._uidvalidity_seen.get(mailbox)
if prev is not None and current_uidvalidity != prev:
new_uidvalidity = current_uidvalidity
self._uidvalidity_seen[mailbox] = current_uidvalidity
if new_uidvalidity is not None:
return MailboxDelta([], [], [], new_uidvalidity, info.get("highestmodseq"))
# New messages: UID SEARCH beyond last_seen_uid (filter the M:* boundary echo).
search = await imap.uid_search(f"UID {last_seen_uid + 1}:*")
candidate_uids = [u for u in parse_search_uids(search.lines) if u > last_seen_uid]
new_messages = await self._fetch_messages(imap, sorted(candidate_uids))
# Flag changes via CONDSTORE when we have a modseq baseline.
flag_changes: list[FlagChange] = []
if highestmodseq is not None:
fresp = await imap.uid("fetch", "1:*", f"(UID FLAGS) (CHANGEDSINCE {highestmodseq})")
if fresp.result == "OK":
new_uid_set = {m.uid for m in new_messages}
for pf in parse_fetch_lines(fresp.lines):
if pf.uid not in new_uid_set:
flag_changes.append(FlagChange(uid=pf.uid, flags=pf.flags))
# TODO(spec): expunge detection needs QRESYNC/VANISHED (M2 hardening).
return MailboxDelta(
new=new_messages,
flag_changes=flag_changes,
expunged_uids=[],
new_uidvalidity=None,
new_highestmodseq=info.get("highestmodseq"),
)
async def idle(self, mailbox: str) -> None:
imap = await self._connect()
if "IDLE" not in (imap.protocol.capabilities or set()):
raise ProviderNotSupported("server does not support IDLE")
await self._select(mailbox)
idle_task = await imap.idle_start(timeout=_IDLE_TIMEOUT)
try:
await imap.wait_server_push()
finally:
imap.idle_done()
with contextlib.suppress(Exception):
await asyncio.wait_for(idle_task, timeout=10)
async def push_flags(
self, mailbox: str, uid: int, add: frozenset[str], remove: frozenset[str]
) -> None:
await self._select(mailbox)
imap = await self._connect()
if add:
await imap.uid("store", str(uid), "+FLAGS.SILENT", f"({' '.join(sorted(add))})")
if remove:
await imap.uid("store", str(uid), "-FLAGS.SILENT", f"({' '.join(sorted(remove))})")
async def create_mailbox(self, path: str) -> None:
"""Create a mailbox on the server (idempotent — ignores 'already exists')."""
imap = await self._connect()
with contextlib.suppress(Exception):
await imap.create(path)
async def move(self, uid: int, src: str, dst: str) -> int:
await self._select(src)
imap = await self._connect()
resp = await imap.uid("move", str(uid), dst)
if resp.result != "OK":
raise ProviderConnectError(f"MOVE {uid} -> {dst} failed")
for line in resp.lines:
if isinstance(line, (bytes, bytearray)):
m = _COPYUID_RE.search(bytes(line))
if m:
return int(m.group(1))
return uid
async def delete_messages(self, mailbox: str, uids: list[int]) -> None:
"""Flag the given UIDs \\Deleted and EXPUNGE them from ``mailbox``."""
if not uids:
return
await self._select(mailbox)
imap = await self._connect()
uid_set = ",".join(str(u) for u in uids)
await imap.uid("store", uid_set, "+FLAGS.SILENT", "(\\Deleted)")
try:
# UID EXPUNGE (UIDPLUS) removes only our UIDs; fall back to a plain
# EXPUNGE (all \Deleted in the mailbox) when unsupported.
await imap.uid("expunge", uid_set)
except Exception:
await imap.expunge()
async def append(self, mailbox: str, raw: bytes, flags: frozenset[str]) -> int:
imap = await self._connect()
flag_str = f"({' '.join(sorted(flags))})" if flags else None
resp = await imap.append(raw, mailbox=mailbox, flags=flag_str)
if resp.result != "OK":
raise ProviderConnectError(f"APPEND to {mailbox} failed")
for line in resp.lines:
if isinstance(line, (bytes, bytearray)):
m = _APPENDUID_RE.search(bytes(line))
if m:
return int(m.group(1))
return 0
async def send(self, raw: bytes, envelope_from: str, envelope_to: list[str]) -> None:
cfg = self._cfg
use_tls = cfg.smtp_tls == "ssl"
start_tls = cfg.smtp_tls == "starttls"
try:
await aiosmtplib.send(
raw,
sender=envelope_from,
recipients=envelope_to,
hostname=cfg.smtp_host,
port=cfg.smtp_port,
username=cfg.username,
password=cfg.password,
use_tls=use_tls,
start_tls=start_tls,
timeout=_CONNECT_TIMEOUT,
)
except aiosmtplib.SMTPAuthenticationError as exc:
raise ProviderAuthError(f"SMTP auth failed: {exc}") from exc
except aiosmtplib.SMTPException as exc:
raise ProviderConnectError(f"SMTP send failed: {exc}") from exc