mirror of
https://github.com/root-fr/jmap-webmail.git
synced 2026-09-24 16:01:18 +00:00
Matthieu MALVACHE
2f20aa835b
Logout now revokes the refresh token and redirects to the IdP's end_session_endpoint so the SSO session is fully terminated. The end_session_url is validated server-side (HTTPS only) before being returned to the client, preventing open redirect attacks. Also adds 14 unit tests covering PKCE (including RFC 7636 test vector) and OAuth discovery (fallback, caching, required field validation).
5.3 KiB
5.3 KiB
JMAP Webmail - Roadmap
This document tracks the development status and planned features for JMAP Webmail.
Completed Features
Core Infrastructure
- Next.js 16 with TypeScript and App Router
- Tailwind CSS v4 with Oxide engine
- Zustand state management
- JMAP client implementation (jmap-jam)
Authentication
- Login with JMAP server authentication
- Session management (no password storage for security)
- Username autocomplete with history
- Logout functionality
- Authentication error handling
- OAuth2/OIDC with PKCE (SSO login, session persistence, RP-initiated logout)
JMAP Server Connection
- Session establishment and keep-alive
- Connection error handling and retries
- Storage quota display with progress bar
- Server capability detection
- Shared folders support (multi-account access)
Email Operations
- Email fetching and display
- Full HTML email rendering
- Compose, reply, reply-all, forward
- Draft auto-save with discard confirmation
- Mark as read/unread with configurable delay
- Star/unstar emails
- Delete and archive
- Color tags/labels with background tint display
- Full-text search with pagination
- Attachment upload and download
- Batch operations (multi-select)
- Quick reply form with auto-expand
- Email threading (Gmail-style inline expansion)
- Spam reporting with bidirectional handling (mark as spam / not spam)
- Batch spam operations (mark multiple emails)
- Newsletter unsubscribe (RFC 2369 List-Unsubscribe support)
Identity Management
- Multiple email identities with CRUD operations
- Per-identity custom signatures
- Identity selector in composer
- Sub-addressing support (user+tag@domain.com)
- Sub-address helper with tag suggestions
- Identity badges in email viewer and list
- Identities settings panel
Real-time Updates
- EventSource for JMAP push notifications
- State synchronization
- Email arrival notifications with toast messages
- Real-time unread counts
- Mailbox change handling
- Connection status indicator
User Interface
- Three-pane layout (sidebar, list, viewer)
- Minimalist design system with gray palette
- Dark and light theme support with system preference detection
- Dark mode email readability (intelligent color transformation)
- Custom scrollbars
- Mobile responsive design with adaptive layout
- Keyboard shortcuts (j/k navigation, r/f actions, etc.)
- Drag-and-drop email organization
- Right-click context menus
- Hierarchical mailbox display
- Email list with avatars and visual hierarchy
- Expandable email headers with technical details
- External content warning banner (unified with unsubscribe)
- SPF/DKIM/DMARC status indicators
- Loading states and skeletons
- Smooth transitions with cross-fade effects
- Infinite scroll pagination
- Error boundaries
- Settings page with multiple categories
Internationalization
- English language support
- French language support
- Japanese language support
- Automatic browser language detection
- Language preference persistence
- Timezone auto-detection
Security & Privacy
- External content blocked by default (privacy protection)
- HTML sanitization with DOMPurify (comprehensive XSS prevention)
- User control for loading external content (ask/block/allow policies)
- Newsletter unsubscribe URL validation (protocol whitelist)
- Spam reporting with undo mechanism
- Email header security indicators (SPF/DKIM/DMARC)
- Trusted senders list for automatic image loading
Deployment
- Runtime environment variables (Docker-friendly configuration)
- Environment variable management (.env.local and .env.example)
Planned Features
Address Book & Contacts
- Contact store with CRUD operations
- Contacts list view with search/filter
- Contact details view/edit form
- Contact groups management
- vCard import/export
- JMAP contacts sync (if server supports)
- Email autocomplete from contacts
- Contacts integration in composer
- Bulk contact operations
Advanced Features
- Email filters and rules
- Calendar integration (JMAP Calendars)
- Email templates
- Vacation responder settings
- Advanced search with filters
- Email encryption (PGP/GPG)
Performance Optimizations
- Virtual scrolling for large lists
- Email content caching
- Bundle size optimization
- Service worker for offline support
- Lazy loading for attachments
- Image optimization for email content
Testing
- Unit tests for utilities (validation, color transformation - 97 tests)
- Component tests
- E2E tests with Playwright
- Accessibility testing
- Performance testing
Deployment
- Health check endpoint
- Production build optimizations
- Monitoring and logging
Security Enhancements
- CSP headers configuration
- Additional XSS protection layers (X-XSS-Protection, etc.)
- Rate limiting
- CORS configuration
Known Issues
- Next.js workspace root warning (cosmetic)
Contributing
Want to help implement a feature? Check out our CONTRIBUTING.md guide!