2 Commits

Include renames

Author	SHA1	Message	Date
lukasandClaude Opus 5.5	addb2232a1	Security hardening from the assessment; testing fixes ... Security (ultimo-security-report.md): - Security headers on every response, the app shell included: they lived at server level and nginx dropped them in any location with its own header. CSP, framing, nosniff, referrer, permissions (docker/nginx-security.conf). - Plain HTTP forwarded by the reverse proxy is redirected to HTTPS; HSTS on HTTPS responses. server_tokens off. - Cross-site state-changing /api requests refused (login CSRF), WebSocket too. - Validation errors in the usual error shape, without the request model. - New-password policy: max 128, common/own-address/repeated refused, breached-password check (HIBP k-anonymity, fails open). - Message HTML: links keep only http(s)/mailto (sanitizer v6); the HTML endpoint carries its own no-script CSP. - Outbound fetches pinned to the checked IP (DNS rebinding); external IMAP/SMTP servers re-checked before each connection; CGNAT and mapped addresses counted as non-public. Fixes from testing: - IDLE loop catches up before idling: mail that came while the worker was away no longer waits up to 10 minutes. - Restore from Spam/Trash/Archive moves only the removed messages, not your reply in Sent. - Narrow desktop list stacks sender/subject/snippet (subject was squeezed to nothing at the default width), with hover actions. - Phone: wide emails scale to fit the screen. - Singular forms ("1 message"); no zip button for a single attachment; app passwords no longer claim "never used" for mail apps. - ruff format across the backend. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-14 22:08:06 +02:00
lukasandClaude Opus 4.8	4e077f1a37	M3 plugin platform: SDK + loader, RLS-isolated tables, migrations, jobs ... Backend foundation for the plugin platform (SPEC §11), Phases 1-3. Phase 1 — SDK + loader: - app/plugins/types.py: frozen Plugin/UiManifest/Slot/Page/JobSpec contract. - app/plugins/sdk.py: sdk(name) facade — the only app.* import allowed for plugins (scoped session, plugin.{name}.* publish, blob, outbox, settings, SSRF http_get, KV, enqueue). - app/plugins/loader.py: entry-point discovery (webmail.plugins), hook forwarding (API + worker), router mounting at /api/plugins/{name}, ui-manifest aggregation. - plugin_kv core table (migration 0013) + GET /api/plugins/ui-manifest. Phase 2 — non-removable core plugins + DB-enforced privacy: - builtin flag (calendar/contacts will be builtin=True; uninstall refuses them). - RLS per-user isolation on plg_* tables: least-privilege webmail_plugin role (migration 0014), plugin_session(user_id) sets LOCAL ROLE + app.current_user_id, rls.enable_rls() (ENABLE+FORCE RLS + USING/WITH CHECK policy). Mail untouched. - Per-plugin Alembic runner (shared env, dedicated version table) + install/uninstall --drop-data CLI; skeleton fixture proves install -> run -> uninstall --drop-data leaves zero residue (§12 M3 acceptance). Phase 3 — plugin jobs (§11.2): - JobSpec registered as arq function plg.{plugin}.{func} + cron (5-field parser); singleton=True guarded by a per-(plugin,user) Redis lock; wired onto the shared interactive worker. Gates: ruff, mypy --strict (94 files + tests), full suite 326 passed. RLS isolation, migration round-trip, and singleton lock covered by tests. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Rcj3TpydMTzTSmU7kunzf8	2026-07-26 21:42:35 +02:00