Gmail (app-password) onboarding: auth_strategy routing + credential-helper panel
Implements SPEC v1.5 §6.2.1–6.2.3 so Gmail (and Yahoo/iCloud/Outlook-personal) onboard via a provider app password on the existing plain-password sync path — no OAuth, no new sync code. Gmail was oauth2-only with OAuth unimplemented, so it was previously un-addable. Backend: - presets.yaml: each preset declares an ordered `auth_strategy`; Gmail becomes `auth: password` + `[app_password, oauth2]`. App-password providers ship a data-driven `help:` block (deep_link, app_name_hint, i18n step keys, docs_url). - discovery/types: CandidateConfig carries `auth_strategy` + `HelpBlock`; presets load them and autoconfig candidates derive a default from the detected auth. - schemas/api: CandidateOut exposes auth_strategy + help; DiscoverResponse adds `google_oauth_enabled`. - config: GOOGLE_OAUTH_ENABLED flag (default false) gates the OAuth fallback. Frontend: - ProviderCredentialPanel (wizard step 1.5): deep-link popup (user gesture), rendered steps, single paste field that strips whitespace, instant verify (auto POST /accounts/test at 16 chars → Connected ✓ / mapped error), and the auth_failed recovery branch with a gated "Sign in with Google instead" button. - AccountWizard routes app-password providers to the panel, then a details step. - i18n keys (en) for the panel + provider steps. Honors the §6.2.2 prohibitions: no page automation, no real-password capture, no scraping — deep-link + guide + paste + test only. Adds the v1.5 spec. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01U72FZiF1W1pb8XxyWBTREA
This commit is contained in:
Claude Opus 4.8
@@ -2,27 +2,59 @@
|
||||
# Matched by the domain of the email address. Each entry gives IMAP + SMTP
|
||||
# host/port/tls, the auth kind, and an oauth provider id when applicable.
|
||||
# tls: "ssl" (implicit TLS) | "starttls"; auth: "password" | "oauth2".
|
||||
#
|
||||
# auth_strategy (SPEC §6.2.1): ordered list of the credential flows the wizard
|
||||
# offers, first = default. Values: app_password | oauth2 | password.
|
||||
# - app_password → renders the ProviderCredentialPanel keyed by help.help_id
|
||||
# (deep-link + guide + paste + test); the value is used as a normal IMAP/SMTP
|
||||
# password, so it reuses the plain-password sync path (zero new sync code).
|
||||
# - oauth2 → XOAUTH2 (M2); for Google it is the *fallback* offered when the app
|
||||
# password path fails and GOOGLE_OAUTH_ENABLED is set.
|
||||
# - password → the generic password box (self-hosted / ISP accounts).
|
||||
# help (SPEC §6.2.2/6.2.3): data for the panel. steps are i18n message keys so
|
||||
# the copy is translatable; app_name_hint is a suggested app-password label.
|
||||
|
||||
providers:
|
||||
google:
|
||||
domains: [gmail.com, googlemail.com]
|
||||
imap: { host: imap.gmail.com, port: 993, tls: ssl }
|
||||
smtp: { host: smtp.gmail.com, port: 465, tls: ssl }
|
||||
auth: oauth2
|
||||
auth: password
|
||||
auth_strategy: [app_password, oauth2]
|
||||
oauth_provider: google
|
||||
help:
|
||||
help_id: gmail
|
||||
deep_link: https://myaccount.google.com/apppasswords
|
||||
app_name_hint: "ultimo.email"
|
||||
docs_url: https://support.google.com/mail/answer/185833
|
||||
steps:
|
||||
- wizard.help.gmail.step1
|
||||
- wizard.help.gmail.step2
|
||||
- wizard.help.gmail.step3
|
||||
|
||||
microsoft:
|
||||
domains: [outlook.com, hotmail.com, live.com, msn.com]
|
||||
imap: { host: outlook.office365.com, port: 993, tls: ssl }
|
||||
smtp: { host: smtp.office365.com, port: 587, tls: starttls }
|
||||
auth: oauth2
|
||||
auth: password
|
||||
auth_strategy: [app_password, oauth2]
|
||||
oauth_provider: microsoft
|
||||
help:
|
||||
help_id: outlook
|
||||
deep_link: https://account.microsoft.com/security
|
||||
app_name_hint: "Webmail"
|
||||
docs_url: https://support.microsoft.com/account-billing/using-app-passwords-with-apps-that-don-t-support-two-step-verification-5896ed9b-4263-e681-128a-a6f2979a7944
|
||||
steps:
|
||||
- wizard.help.outlook.step1
|
||||
- wizard.help.outlook.step2
|
||||
- wizard.help.outlook.step3
|
||||
|
||||
office365:
|
||||
domains: [office365.com]
|
||||
imap: { host: outlook.office365.com, port: 993, tls: ssl }
|
||||
smtp: { host: smtp.office365.com, port: 587, tls: starttls }
|
||||
auth: oauth2
|
||||
auth_strategy: [oauth2]
|
||||
oauth_provider: microsoft
|
||||
|
||||
yahoo:
|
||||
@@ -30,39 +62,64 @@ providers:
|
||||
imap: { host: imap.mail.yahoo.com, port: 993, tls: ssl }
|
||||
smtp: { host: smtp.mail.yahoo.com, port: 465, tls: ssl }
|
||||
auth: password
|
||||
auth_strategy: [app_password]
|
||||
help:
|
||||
help_id: yahoo
|
||||
deep_link: https://login.yahoo.com/account/security/app-passwords
|
||||
app_name_hint: "Webmail"
|
||||
docs_url: https://help.yahoo.com/kb/SLN15241.html
|
||||
steps:
|
||||
- wizard.help.yahoo.step1
|
||||
- wizard.help.yahoo.step2
|
||||
- wizard.help.yahoo.step3
|
||||
|
||||
icloud:
|
||||
domains: [icloud.com, me.com, mac.com]
|
||||
imap: { host: imap.mail.me.com, port: 993, tls: ssl }
|
||||
smtp: { host: smtp.mail.me.com, port: 587, tls: starttls }
|
||||
auth: password
|
||||
auth_strategy: [app_password]
|
||||
help:
|
||||
help_id: icloud
|
||||
deep_link: https://account.apple.com/account/manage
|
||||
app_name_hint: "Webmail"
|
||||
docs_url: https://support.apple.com/102654
|
||||
steps:
|
||||
- wizard.help.icloud.step1
|
||||
- wizard.help.icloud.step2
|
||||
- wizard.help.icloud.step3
|
||||
|
||||
gmx:
|
||||
domains: [gmx.com, gmx.net, gmx.de]
|
||||
imap: { host: imap.gmx.com, port: 993, tls: ssl }
|
||||
smtp: { host: mail.gmx.com, port: 587, tls: starttls }
|
||||
auth: password
|
||||
auth_strategy: [password]
|
||||
|
||||
wp:
|
||||
domains: [wp.pl]
|
||||
imap: { host: imap.wp.pl, port: 993, tls: ssl }
|
||||
smtp: { host: smtp.wp.pl, port: 465, tls: ssl }
|
||||
auth: password
|
||||
auth_strategy: [password]
|
||||
|
||||
onet:
|
||||
domains: [onet.pl, poczta.onet.pl, op.pl]
|
||||
imap: { host: imap.poczta.onet.pl, port: 993, tls: ssl }
|
||||
smtp: { host: smtp.poczta.onet.pl, port: 465, tls: ssl }
|
||||
auth: password
|
||||
auth_strategy: [password]
|
||||
|
||||
o2:
|
||||
domains: [o2.pl, tlen.pl]
|
||||
imap: { host: imap.poczta.o2.pl, port: 993, tls: ssl }
|
||||
smtp: { host: smtp.poczta.o2.pl, port: 465, tls: ssl }
|
||||
auth: password
|
||||
auth_strategy: [password]
|
||||
|
||||
interia:
|
||||
domains: [interia.pl, interia.eu]
|
||||
imap: { host: imap.poczta.interia.pl, port: 993, tls: ssl }
|
||||
smtp: { host: smtp.poczta.interia.pl, port: 465, tls: ssl }
|
||||
auth: password
|
||||
auth_strategy: [password]
|
||||
|
||||
Reference in New Issue
Block a user