lukasandClaude Opus 4.8
8c634f7967
Calendar plugin (webmail_plugin_calendar, non-removable core plugin): - Local calendars/events CRUD with RLS isolation; recurrence expanded at query time (DST-correct), EXDATE + detached-override merge. - Calendar app bundle: month/week/day/3-day views, mini-month, event form (color, show-as, timezone combobox, repeat, reminders, guests w/ recipient autocomplete, Jitsi video call), event popover with RSVP badges, resizable/ collapsible left panel + theme toggle, overlap layout. - iMIP invites: sdk.mail sends REQUEST from the organizer's mailbox (HTML + text/calendar + invite.ics); public /rsvp endpoint (vault-sealed token) records accepted/declined/tentative per attendee. - "This and following" edit + scoped delete (this / this-and-following), with a delete confirmation dialog for recurring events. Core: - Settings: time_format (12/24h, default 24h) + jitsi_server; new Integrations section; date order follows time format (en-GB vs en-US) across Mail. - Plugin SDK: mail (send from a user's account), vault (envelope encrypt), multi-method SSRF-guarded http; AppSwitcher product switcher; full-bleed PluginPage. Mail HTML rendering: - Sanitizer allows <style> blocks + class (CSS sanitized: drop script-like, strip @import/url() when remote images blocked); SANITIZER_VERSION 3 so already-indexed mail re-sanitizes on view. - Attachments: a Content-Disposition: attachment part is a real attachment even when it also carries a Content-ID (fixes hidden invite.ics). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
98 lines
3.2 KiB
Python
98 lines
3.2 KiB
Python
"""User settings + per-sender image allowlist (SPEC §9.1 Settings, §9.4)."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from typing import Annotated
|
|
|
|
from fastapi import APIRouter, Depends
|
|
from pydantic import BaseModel
|
|
from sqlalchemy import func, select
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|
|
|
from app.db import get_session
|
|
from app.identity.deps import CurrentUser, require_csrf
|
|
from app.models import Message, User
|
|
|
|
router = APIRouter(prefix="/settings", tags=["settings"])
|
|
|
|
DbSession = Annotated[AsyncSession, Depends(get_session)]
|
|
|
|
_ALLOWED_ORDER = {"asc", "desc"}
|
|
_ALLOWED_TIME_FORMAT = {"12", "24"}
|
|
|
|
|
|
class SettingsOut(BaseModel):
|
|
thread_order: str = "asc"
|
|
tz: str = "UTC"
|
|
time_format: str = "24" # 12 = AM/PM, 24 = 24-hour (default); applies app-wide
|
|
jitsi_server: str = "" # blank => https://meet.jit.si/
|
|
allowed_image_senders: list[str] = []
|
|
|
|
|
|
class SettingsPatch(BaseModel):
|
|
thread_order: str | None = None
|
|
tz: str | None = None
|
|
time_format: str | None = None
|
|
jitsi_server: str | None = None
|
|
|
|
|
|
class QuotaOut(BaseModel):
|
|
used_bytes: int
|
|
quota_bytes: int
|
|
|
|
|
|
def allowed_image_senders(user: User) -> set[str]:
|
|
value = user.settings.get("allowed_image_senders", [])
|
|
if isinstance(value, list):
|
|
return {str(e).lower() for e in value}
|
|
return set()
|
|
|
|
|
|
def add_allowed_image_sender(user: User, email: str) -> None:
|
|
current = sorted(allowed_image_senders(user))
|
|
if email.lower() not in current:
|
|
current.append(email.lower())
|
|
# Reassign the whole dict so SQLAlchemy detects the JSONB change.
|
|
user.settings = {**user.settings, "allowed_image_senders": current}
|
|
|
|
|
|
def _settings_out(user: User) -> SettingsOut:
|
|
s = user.settings
|
|
return SettingsOut(
|
|
thread_order=str(s.get("thread_order", "asc")),
|
|
tz=str(s.get("tz", "UTC")),
|
|
time_format=str(s.get("time_format", "24")),
|
|
jitsi_server=str(s.get("jitsi_server", "")),
|
|
allowed_image_senders=sorted(allowed_image_senders(user)),
|
|
)
|
|
|
|
|
|
@router.get("", response_model=SettingsOut)
|
|
async def get_settings_endpoint(user: CurrentUser) -> SettingsOut:
|
|
return _settings_out(user)
|
|
|
|
|
|
@router.get("/quota", response_model=QuotaOut)
|
|
async def get_quota(user: CurrentUser, db: DbSession) -> QuotaOut:
|
|
"""Storage quota and current usage (sum of stored message sizes)."""
|
|
used = await db.scalar(
|
|
select(func.coalesce(func.sum(Message.size_bytes), 0)).where(Message.user_id == user.id)
|
|
)
|
|
return QuotaOut(used_bytes=int(used or 0), quota_bytes=user.quota_bytes)
|
|
|
|
|
|
@router.patch("", response_model=SettingsOut, dependencies=[Depends(require_csrf)])
|
|
async def patch_settings(body: SettingsPatch, user: CurrentUser, db: DbSession) -> SettingsOut:
|
|
updates = dict(user.settings)
|
|
if body.thread_order is not None and body.thread_order in _ALLOWED_ORDER:
|
|
updates["thread_order"] = body.thread_order
|
|
if body.tz is not None:
|
|
updates["tz"] = body.tz
|
|
if body.time_format is not None and body.time_format in _ALLOWED_TIME_FORMAT:
|
|
updates["time_format"] = body.time_format
|
|
if body.jitsi_server is not None:
|
|
updates["jitsi_server"] = body.jitsi_server.strip()
|
|
user.settings = updates
|
|
await db.commit()
|
|
return _settings_out(user)
|