Basic Auth sessions now persist across page refreshes via an encrypted
httpOnly cookie (AES-256-GCM). The feature is opt-in: admin sets
SESSION_SECRET env var, user checks "Remember me" at login.
Rework the 2FA input from a checkbox+animated panel to a discreet
"I have a 2FA code" text link that reveals the TOTP field on click.
Logout now revokes the refresh token and redirects to the IdP's
end_session_endpoint so the SSO session is fully terminated. The
end_session_url is validated server-side (HTTPS only) before being
returned to the client, preventing open redirect attacks.
Also adds 14 unit tests covering PKCE (including RFC 7636 test vector)
and OAuth discovery (fallback, caching, required field validation).
Support external IdPs (Keycloak, Authentik) that handle auth separately
from the JMAP server via OAUTH_ISSUER_URL. Also surfaces discovery
failures with logged errors and a visible warning banner instead of
silently hiding the SSO button.
Add OAuth2 authorization code flow with PKCE as an alternative to
basic auth. Supports Stalwart's built-in OAuth provider with automatic
token refresh, session persistence via httpOnly cookies, and graceful
fallback to basic auth when OAuth is not configured.
Sent emails only included the bare email address in the From field,
so recipients saw <user@example.com> with no display name. Now the
identity name from the JMAP server is included in the From header
for composed emails, quick replies, and saved drafts.
Also sorts identities so the one matching the login username is
selected by default in the composer dropdown.
When editing a recurring event and clearing its recurrence, the update
patch was omitting recurrenceRules entirely instead of setting it to null.
The server never received the change. Also clear recurrenceOverrides and
excludedRecurrenceRules so orphaned exceptions don't persist. Same fix
applied to locations and alerts removal.
Fix "this_and_future" scope overriding recurrence removal by reordering
the spread so user updates take precedence over master's original rules.
Closesroot-fr/jmap-webmail#14
Address GitHub issue #13 (events not spanning real duration, hour label alignment)
and add five standard calendar UX features:
- Click-drag on empty time slots to create events with pre-filled time range
- Resize events by dragging bottom edge handle (15-min snap, optimistic JMAP update)
- Recurring event edit/delete scope dialog (this/following/all occurrences)
- Double-click quick create with inline title input (PT1H default)
- Event duplication button in modal (clones +1 day, opens for editing)
Shared interaction logic extracted to hooks/use-time-grid-interactions.ts.
All features include i18n (8 locales), accessibility (ARIA, pointer events),
and proper error handling with toast feedback.
- Add ConfirmDialog component with promise-based useConfirmDialog hook
- Add WelcomeBanner onboarding component with localStorage persistence
- Add NavigationRail (desktop icon rail + mobile bottom tab bar)
- Polish login form (shake on error, TOTP slide, password visibility, session expired banner)
- Add inline form validation with shake animation in email composer and contacts
- Add empty state patterns for contacts (no data vs no search results)
- Improve toast system with undo action support and typed durations
- Add template settings tab to settings page
- Refactor sidebar (cleaner code, remove unused imports)
- Add WCAG AA reduced-motion, safe area insets, sr-only live region
- Add shake/slide animations in globals.css
- Update i18n for all 8 locales
Add organizer/attendee UI with RSVP buttons (accept/maybe/decline),
contact autocomplete in participant input, scheduling message support
via sendSchedulingMessages flag, and DnD notification for participant
events. Add inline calendar invitation banner in email viewer that
auto-detects .ics attachments, parses event details, and allows RSVP
or import to calendar. Includes cancellation display and 51 tests.
Inline the contact filtering directly in useMemo instead of calling
store selectors, so the dependency array accurately reflects what
triggers recomputation.
Dark mode color transform had 3 bugs preventing it from working:
- Hook only ran when external content was blocked, not for all emails
- Checked `theme` ('system') instead of `resolvedTheme` ('dark')
- Only transformed CSS style attrs, missing <font color> and bgcolor
Replaced invert+boost algorithm with blend-toward-white for text
(preserves hue, brighter results) and added background darkening
for light email backgrounds. Also handles color/bgcolor HTML attrs.
Fixed long email subjects pushing action buttons off-screen by adding
min-w-0 to the email viewer flex container in the page layout.
Evaluate JMAP CalendarEventAlert triggers client-side and display toast
notifications when alert times are reached. Extracts notification sound
into shared utility and mounts ToastContainer globally (fixes silent
toast failures across all components).
- Pure alert utilities: offset parsing, fire time computation (start/end),
effective alerts resolution with useDefaultAlerts, pending alert filtering
- Zustand persist store for acknowledged alert deduplication (24h retention)
- Global hook with 60s interval check, proactive 24h event fetch via ref
(isolated from calendar store), stale closure protection
- Settings: calendarNotificationsEnabled, calendarNotificationSound toggles
- Toast icon customization, CalendarAlertProvider in layout
- i18n: all 8 locales (EN/FR/JA/ES/IT/DE/NL/PT)
- 44 tests (36 alert utils + 8 notification store), 558 total passing
Contacts:
- Contact groups/lists with JMAP members map and composer expansion
- vCard import/export with RFC 6350 parser and duplicate detection
- Bulk operations (multi-select, delete, group add, export)
Search:
- Advanced search panel with JMAP filter fields
- Search chips for active filters visualization
- Debounced inputs with AbortController deduplication
Vacation:
- JMAP VacationResponse singleton management
- Settings tab with date range and message configuration
- Sidebar indicator when vacation responder is active
Auth:
- TOTP 2FA support with Stalwart-compatible password$totp format
Infrastructure:
- Docker multi-stage build with standalone Next.js output
- Structured server-side logger with text/JSON format
- CSP Report-Only and security headers via proxy middleware
- Layout refactoring (HTML structure in root layout)
- Playwright E2E framework setup
Testing: 450+ tests (identity, contacts, vCard, threads, headers, components)
i18n: All new strings added to all 8 locales
Remove width: max-content and display: inline-block from email content
CSS that caused horizontal scroll and left-side text clipping. Collapse
empty table cells/containers when external images are blocked to prevent
large blank areas in newsletter emails.
Implement Phase 1 of contacts support — the biggest missing feature
on the roadmap. Uses RFC 9553 (JSContact) data model and RFC 9610
(JMAP for Contacts) when the server advertises the capability,
falling back to localStorage for servers without contact support.
- JMAP types for ContactCard, AddressBook, NameComponent, etc.
- JMAP client methods: CRUD, search, address book listing
- Refactored request() to accept dynamic `using` capabilities
- Zustand contact store with dual-mode persistence
- Full contacts page with two-column layout (list + detail/edit)
- Contact form with multi-email/phone, context labels, validation
- Composer autocomplete on To/Cc/Bcc with keyboard nav and ARIA
- Sidebar navigation link to contacts
- Auth integration: fetch on login, clear on logout
- i18n: contacts.* namespace across all 8 languages
- Replace hardcoded hex colors (#666, #999) with CSS variables in email preview
- Strengthen blockquote text color from #6b7280 to #4b5563 (5.3:1 → 7.8:1 contrast)
- Strengthen quoted email text color to match blockquote improvement
- Add comprehensive accessibility guidelines to CLAUDE.md
- Document color contrast standards, testing requirements, and best practices
- All changes maintain dark mode compatibility
Achieves WCAG 2.0 Level AA compliance for all text elements.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Implement comprehensive spam management allowing users to report spam emails and restore false positives. Emails are moved to/from the Junk folder with toast notifications and undo support.
Key features:
- Mark as spam: moves email to Junk folder with 5-second undo
- Mark as not spam: restores email from Junk to inbox
- Batch spam operations via context menu
- Smart toggle based on current folder (Junk vs other folders)
- Keyboard shortcut (Shift+!) for quick spam reporting
- Full i18n support (EN/FR)
- Shared mailbox compatibility
UX improvements:
- Toast notifications with undo action using sonner library
- Auto-deselect email after spam action
- Visual distinction with red destructive styling
- Desktop button + context menu + keyboard shortcuts
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Complete internationalization coverage for all identity-related UI elements,
including mobile navigation, batch actions, and recipient formatting. Improve
sub-address badge to detect and display tags for emails received at
user+tag@domain.com addresses, not just sent emails. Add contextual recipient
display showing "me" for current user and "Name and X others" for multiple
recipients. Update documentation to reflect completed identity management
implementation.
Enable users to manage multiple sending identities and organize incoming mail with sub-addressing (user+tag@domain.com format). Provides better email organization, privacy through disposable addresses, and flexibility for users with multiple roles or accounts.
Replaces all remaining hardcoded strings with translation keys to ensure full localization support across the application. This allows users to experience the entire interface in their preferred language without any English fallbacks.
Implements /api/health endpoint for Docker/Kubernetes liveness and readiness probes.
- Basic mode: Returns 200 OK or 503 based on memory usage thresholds
- Detailed mode (?detailed=true): Includes memory stats, uptime, and environment info
- HEAD method support for lightweight polling
- Memory-based health monitoring (85% warning, 95% critical)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Refactored i18n implementation to support seamless language switching
without page reload by pre-loading all translations and using
locale-aware navigation helpers.
Changes:
- Created centralized routing config (i18n/routing.ts) with localePrefix: 'never'
- Added type-safe navigation helpers (i18n/navigation.ts)
- Implemented custom IntlProvider with pre-loaded EN/FR translations
- Updated all pages to use new useRouter from i18n/navigation
- Added language switcher to appearance settings
- Removed URL-based locale routing (no more /en/ or /fr/ prefixes)
- Language preference persisted via Zustand localStorage
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Add tablet list auto-hide: email list collapses when selecting an email
on tablet (768-1024px), with back button to return to two-pane view
- Make sender info scrollable on mobile/tablet while keeping subject bar
with action buttons sticky at top for quick access
- Extend overlay sidebar behavior to tablet viewport (768-1024px)
- Add body scroll lock when sidebar is open on mobile/tablet
- Fix backdrop only rendering on mobile/tablet (not desktop)
- Add proper i18n keys for back_to_list, important, close
- Simplify desktop-only CSS classes by removing redundant breakpoint prefixes
Enable post-build configuration by reading env vars at request time
instead of build time. This allows Docker containers to be configured
without rebuilding the image.
- Add /api/config endpoint for runtime config
- Add useConfig hook with caching
- Update login page with proper loading/error states
- Add i18n translations for config errors
- Maintain backwards compatibility with NEXT_PUBLIC_* vars
- Add getIdentities() method to JMAP client
- Fetch and store identities in auth store on login
- Add From selector in composer (dropdown for multiple identities)
- Pass identity email/ID through send flow instead of using username
- Add translations for From field (en/fr)
This allows proper sender address handling for LDAP and other auth
backends where username differs from email address.
Closes#5
- Fix textarea colors for proper theme support (light/dark mode)
- Fix modal height to prevent composer from collapsing
- Add explicit "Discard" button in footer for better UX
- Fix hardcoded colors in attachments section for theme support
- Use translations for all user-facing text
Closes#6
- Add pagination support to searchEmails (was limited to 50 results)
- Search now scoped to current mailbox/folder
- Support shared mailbox folders in search
- Display total results count (e.g., "50 of 1400 conversations")
- Add clear (X) button to search input
- Re-run search when changing folders during active search
- Remove unused sidebar screenshot
- Add NEXT_PUBLIC_APP_NAME env variable for custom branding
- Update login page to use configurable app name
- Simplify default title in locales to 'Webmail'
- Implement thread grouping by threadId in email list
- Add ThreadListItem with collapsed/expanded states for desktop
- Create ThreadConversationView for full-screen mobile experience
- Add thread utility functions for grouping and sorting
- Extend JMAP client with getThread() and getThreadEmails() methods
- Add keyboard shortcut 'x' to expand/collapse threads
- Add thread expansion state management in email store
- Fix React hooks order in login page
- Add .env.example for environment configuration
- Add husky for git hooks
New features:
- Keyboard shortcuts (j/k navigation, r/R/f for reply/forward, s star, e archive, # delete)
- Drag-and-drop emails to mailbox folders with multi-select support
- Right-click context menus on email list items with all actions
- Mobile-responsive adaptive layout with hamburger menu navigation
New files:
- hooks/use-keyboard-shortcuts.ts - Global keyboard shortcut handling
- hooks/use-email-drag.ts, hooks/use-mailbox-drop.ts - Native HTML5 DnD API
- hooks/use-context-menu.ts, components/ui/context-menu.tsx - Context menu system
- hooks/use-media-query.ts, stores/ui-store.ts - Responsive breakpoint handling
- components/layout/mobile-header.tsx - Mobile navigation header
- contexts/drag-drop-context.tsx - Drag-drop state management
- components/keyboard-shortcuts-modal.tsx - Help modal (? key)
- components/email/email-context-menu.tsx - Email-specific context menu
Updated TODO.md with completed tasks and code audit summary
- Implement error boundaries with graceful fallbacks for all major components
(sidebar, email list, email viewer, composer)
- Add push notifications via EventSource for real-time email updates
- Show connection status indicator in sidebar footer
- Play notification sound and show toast for new emails
- Add global error handler and error reporting utilities
- Configure ESLint with modern flat config
- Various fixes: unused variable warnings, proper cleanup on disconnect
- Update translations for error messages (EN/FR)
- showPreview: Conditionally render email preview in list based on setting
- externalContentPolicy: Control external content (ask/block/allow modes)
- deleteAction: Move to trash or permanently delete based on preference
- debugMode: Add conditional logging via new lib/debug.ts utility
Also includes:
- Add moveToTrash method to JMAP client for trash-based deletion
- Update TODO.md with verified implementation status
- Migrate middleware.ts to proxy.ts (Next.js deprecation)
- Fix dark mode folder selection not visible by improving accent color contrast (#1e3a8a)
- Fix inbox not selected by default on login (auto-select primary account inbox)
- Fix email store not cleared on logout (proper state reset between sessions)
- Add settings page with appearance, email behavior, and advanced options
- Integrate mark-as-read delay setting with proper useEffect implementation
- Reset dataLoaded flag on logout to ensure fresh data load on next login
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add overflow-hidden to sidebar container to prevent absolute positioned menu from extending page height
- Improve theme consistency in email viewer security indicators
- Add AI spam analysis display (X-Spam-LLM header support)
- Enhance dark mode support with better color variables
- Update CLAUDE.md with commit/push guidelines
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Implemented full support for JMAP shared folders (delegated mailboxes):
Core Features:
- Multi-account mailbox fetching from all available JMAP accounts
- Virtual "Shared Folders" parent with account grouping in sidebar
- ID namespacing to prevent collisions across accounts (e.g., "b0:a" for shared Inbox)
- Account-aware email operations (fetch, view, mark as read)
Technical Implementation:
- Store all accounts from JMAP session (primary + shared)
- Transform mailbox IDs: primary uses original, shared use "accountId:mailboxId" format
- Store originalId for JMAP queries while using namespaced IDs in UI
- Transform email mailboxIds to match namespaced mailbox IDs for proper counter updates
- Pass accountId parameter through entire operation chain (fetch, view, mark read)
UI/UX Enhancements:
- Blue Users/User icons for shared folders in sidebar
- Hierarchical display with account grouping
- Proper unread counters that update when marking emails read
- Auto-mark emails as read when opened in shared folders
Bug Fixes:
- Fixed email content fetching showing wrong message in shared folders
- Fixed unread counters not updating for shared mailboxes
- Fixed mark-as-read not working on server for shared accounts
- Cleaned up debug logging
Added dynamic page titles that update based on current context:
- Mailbox view: "Inbox (3) - Webmail" (with unread count)
- Reading email: "[Subject] - Webmail"
- Composing: "New Message - Webmail" (or Reply/Forward)
- Login page: "Login - Webmail"
Improved UX with at-a-glance information in browser tabs and better
navigation context. Supports i18n for all title components.
Email Sending:
- Fix identity lookup for email submission (now properly fetches identities from server)
- Add Sent mailbox requirement for sending emails
- Add proper error handling and validation for email submission
Quick Reply Form:
- Replace dummy input with fully functional quick reply system
- Add state management for reply text with auto-expand on focus
- Implement direct send functionality without modal
- Add loading states and error handling
- Show character counter and action buttons (Cancel, More options, Send)
- Use real user avatar and email from auth store
- Auto-refresh email list after sending
Draft Auto-Save Integration:
- Fix critical issue where auto-saved drafts were ignored when sending
- Pass draftId through entire send chain (composer → store → client)
- Wait for pending auto-save before sending to prevent race conditions
- Add draft cleanup with discard confirmation when closing composer
- Delete orphaned drafts when user confirms discard
- Add i18n support for discard confirmation (EN/FR)
Benefits:
- No more orphaned drafts in Drafts folder
- Better performance (updates existing draft vs creating new email)
- Cleaner UX with proper draft lifecycle management
- Quick replies are truly quick (no modal needed)
- All user-facing messages properly translated
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Improved email loading UX with a polished cross-fade approach:
**Visual Continuity:**
- Removed jarring selectEmail(null) call that caused blank screen
- Current email stays visible while new one loads
- Smooth transition instead of abrupt pop-in
**Loading Feedback:**
- Semi-transparent overlay with subtle backdrop blur (2px)
- Centered loading card with spinner and message
- Small loading indicator in email header
- Both overlays fade in smoothly (200ms)
**React Optimization:**
- Added key prop based on email.id to email viewer
- Triggers proper React animations on email change
- Combined with 300ms fade-in creates smooth cross-fade effect
**Result:**
When clicking an email, the current email remains visible with a subtle
dimming effect while the new email loads, then smoothly transitions to
the new content. No more visual glitches or jarring blank screens.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Enhanced the batch operations UI with polished animations and transitions:
**Toolbar Animations:**
- Smooth slide-down transition for batch actions toolbar (300ms ease-in-out)
- Animated slide-in effects for selection count and action buttons
- Collapsible toolbar with max-height and opacity transitions
**Checkbox Animations:**
- Zoom-in animation when checkboxes are checked (200ms)
- Scale effects on hover (110%) and active (95%) states
- Smooth opacity transitions for unchecked states
- Color transitions for checked state (blue theme)
**Selection Feedback:**
- Blue ring highlight on selected email items
- Subtle background tint for selected emails
- Animated "select all" button with scale and zoom effects
- Visual separator between action buttons
**Loading States:**
- Spinning loader icons during batch operations
- Disabled state with reduced opacity during processing
- 500ms delay after operations for smooth visual feedback
- Prevents multiple simultaneous batch operations
**Visual Polish:**
- Hover effects with background color transitions
- Active state feedback on all interactive elements
- Proper pluralization (email/emails) in selection count
- Consistent transition timing across all animations
All animations use Tailwind's built-in utilities and follow smooth easing curves for a premium feel.
🤖 Generated with Claude Code
Co-Authored-By: Claude <noreply@anthropic.com>
- Add justSelectedSuggestion ref to track when a suggestion is selected
- Skip showing suggestions in useEffect when selection just occurred
- Fixes issue where menu would reopen immediately after Enter key selection
- Removed isLoading from main loading condition
- Now only shows full-screen loader for auth/initial load
- Email list handles its own loading state when switching folders
- Eliminates jarring fade in/fade out effect when navigating between mailboxes
- Added .env.local file with JMAP server URL configuration
- Created .env.example template for other developers
- Simplified login page UI with minimalist design
- Removed technical references to JMAP protocol
- Removed unnecessary security notes from login page
- Updated translations to use simpler, user-friendly language
- Disabled browser autocomplete for username field
- Redesigned login page with modern gradient background and refined styling
- Improved form input styling with better focus states
- Added loading spinner animation for better UX
- Updated all components to use theme CSS variables instead of hardcoded gray colors
- Fixed issue where light mode only changed borders but not backgrounds
- Components now properly respect theme switching with consistent colors
- Replaced bg-gray-*, text-gray-*, border-gray-* with theme variables (bg-background, text-foreground, etc.)
Affected components:
- Main page layout
- Login page
- Sidebar navigation
- All UI components (Button, Input, Toast, Language Switcher)
- Email viewer, list, and list items
Matthieu MALVACHE
Matthieu MALVACHEandClaude