diff --git a/.github/workflows/static-lite.yml b/.github/workflows/static-lite.yml
index 149e12036..9def1243f 100644
--- a/.github/workflows/static-lite.yml
+++ b/.github/workflows/static-lite.yml
@@ -81,6 +81,12 @@ jobs:
LITE_DEMO_MODE: ${{ inputs.demo }}
run: npm run build:lite
+ # Every host literal in the bundle must be a placeholder, the configured
+ # JMAP server, a built-in host the no-third-party switch turns off, or a
+ # string listed as never requested (#903).
+ - name: Scan the bundle for outside hosts
+ run: node scripts/lite/scan-hosts.mjs out
+
- name: Package zip
env:
REF_NAME: ${{ github.ref_name }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index e9bab4990..42bb670be 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,22 @@
# Changelog
+## Unreleased
+
+### Features
+
+- **Organisation**: Admins can set an organisation signature with placeholders for each user's name, address, company, job title, department and phone numbers, per domain or group, and lock it so it replaces everyone's own signature. Users fill in their details once under Settings > Account. Lines whose details are empty are left out (#908)
+- **Organisation**: Admins can add a legal disclaimer that goes below every message when it is sent, never into drafts, and is shown read-only in the composer
+- **Organisation**: Admins can give every user a library of templates, per domain or group, that users pick under "Organisation" in the template picker and can copy but not change
+- **Templates**: On Stalwart 1.0, members of a group mailbox share team templates, and users' own templates are kept in their account so they follow them to every browser. Templates already in a browser move over on the first sign-in. Admins can lock team templates or leave users only the organisation and team templates
+- **Tags**: On Stalwart 1.0, members of a group mailbox see the same tag names and colors on its mail, in the list, the tag picker, the sidebar and the unified inbox. They edit them under Settings > Folders & tags, where tags already on the group's mail can be given a name. Admins can lock the list per domain or group, for example so only team leads change it (#470, #1310)
+- **Organisation**: Admins can label mail from outside the organisation with an "External" chip and have users confirm before sending to or inviting external recipients (composer, quick reply and meeting invitations), per domain or group. Partner domains and contacts count as internal. This replaces the External Mail Warning plugin, whose safe domains can be imported. Plugins can read `api.host.features.externalSenderLabel` and `externalRecipientWarning`
+- **Organisation**: Admins can sign users out after a time without activity or a fixed time after sign-in, per domain or group. A countdown with "Stay signed in" comes first, open and minimised messages and quick replies are saved as drafts, and the login page says why
+- **Delegates**: Settings > Sharing gives a colleague read, or read and write, access to all mail folders or just the Inbox, calendars and contacts in one step, lists who has access to what, and removes access everywhere at once. Admins can hide it per domain or group and limit every share dialog to read access on Organisation > Sharing
+- **Recover deleted items**: On Stalwart Enterprise with archiving turned on, users bring back mail they deleted for good under Settings > Recover deleted items, or from a link in Trash when there is something to recover. Restored mail goes back to the Inbox unread. Admins can limit how many days back it lists or hide it per domain or group (#1319)
+- **Privacy**: One switch, `NO_THIRD_PARTY_TRAFFIC` or Organisation > Security, stops every connection to services outside your own servers: telemetry, the version check, the built-in push relay, the official extension directory, sender icons, MyMemory translation, map links, OpenPGP key lookups and remote pictures in mail. Plugins that need network access don't run, and the page's CSP allows only the hosts you configured. Push registrations move to your own relay. The admin page lists what stays reachable (#903)
+- **Team inbox**: The new official Team inbox plugin lets members of a team mailbox assign messages to each other, mark them done, and filter by "Assigned to me" and "Open"
+- **Plugins**: Plugins can add keyword filters to the message list, shown as chips above it, put icons on row badges, show actions only in team mailboxes or for some keywords, change several keywords in one step, see the user's own account and which mailboxes are team mailboxes, and keep a small shared value in a team mailbox on Stalwart 1.0. Looking people up in the directory needs the new `directory:read` permission. Plugins can no longer set `$draft`, `$junk`, `$notjunk` or `$phishing`
+
## 1.18.0 (2026-10-26)
1.18.0 works with Stalwart 1.0, released today, as well as with 0.16. Sign-in, calendars, contacts, files and sending were adapted to what changed in 1.0, and a Stalwart that was moved from 0.16 to 1.0 with Stalwart's migration tool keeps working with the same open tabs. It also fixes the findings of a security review of the whole webmail, more places where an action in a view that mixes accounts could hit another account's message with the same id, and a series of calendar bugs around repeating events. Plugins can show their own search results and a count on their buttons, quick reply can be turned off, and a new device offers to restore your saved account list.
diff --git a/app/(main)/[locale]/layout.tsx b/app/(main)/[locale]/layout.tsx
index a44a30286..d34288e8a 100644
--- a/app/(main)/[locale]/layout.tsx
+++ b/app/(main)/[locale]/layout.tsx
@@ -10,6 +10,7 @@ import { ProtocolLaunchHandlerProvider } from "@/components/protocol/protocol-la
import { ProInterfaceRedirect } from "@/components/pro/pro-interface-redirect";
import { ImpersonationReconciler } from "@/components/impersonation/impersonation-reconciler";
import { PluginDialogHost } from "@/components/plugins/plugin-dialog-host";
+import { ExternalRecipientConfirmHost } from "@/components/email/external-recipient-confirm";
import { CommandPaletteHost } from "@/components/command-palette/command-palette";
import { TotpReauthDialog } from "@/components/totp-reauth-dialog";
import { PluginConnectDialog } from "@/components/plugins/plugin-connect-dialog";
@@ -20,6 +21,8 @@ import { PluginOAuthCallbackListener } from "@/components/providers/plugin-oauth
import { PWAInstallPrompt } from "@/components/pwa-install-prompt";
import { PushNotificationPrompt } from "@/components/push-notification-prompt";
import { AccountArchiveRestorePrompt } from "@/components/account-archive-prompt";
+import { SessionTimeoutGuard } from "@/components/session/session-timeout-guard";
+import { AccountTemplateSync } from "@/components/templates/account-template-sync";
import { IS_LITE } from "@/lib/lite";
import { setRequestLocale } from "next-intl/server";
import { locales } from "@/i18n/routing";
@@ -62,8 +65,11 @@ export default async function LocaleLayout({
+
+
{children}
+
diff --git a/app/(main)/[locale]/login/page.tsx b/app/(main)/[locale]/login/page.tsx
index d5b972efa..43b3080e6 100644
--- a/app/(main)/[locale]/login/page.tsx
+++ b/app/(main)/[locale]/login/page.tsx
@@ -35,6 +35,7 @@ import { toAsciiDomain } from "@/lib/idn";
import { usePrefetchMailView } from "@/hooks/use-prefetch-mail-view";
import { buildMobileHandoffUrl, mobileHandoffTarget, signedInLoginAction } from "@/lib/auth/mobile-handoff";
import { MobileHandoffConsent } from "@/components/auth/mobile-handoff-consent";
+import { consumeSessionEnd, type SessionEndReason } from "@/lib/session-policy/sign-out-reason";
/** The domain of a complete address (`user@example.com`), or '' while it is still being typed. */
function completeAddressDomain(username: string): string {
@@ -178,6 +179,7 @@ function VersionBadge() {
function LoginPageContent() {
const router = useRouter();
const t = useTranslations("login");
+ const tSessionLimits = useTranslations("session_limits");
const tTheme = useTranslations("settings.appearance.theme");
const params = useParams();
const searchParams = useSearchParams();
@@ -247,6 +249,8 @@ function LoginPageContent() {
// those sessions then only last as long as the tab (lib/auth/lite-tokens.ts).
const [liteTokenLoginSupported, setLiteTokenLoginSupported] = useState(null);
const [sessionExpired, setSessionExpired] = useState(false);
+ // Signed out by the organisation's idle timeout or maximum session length.
+ const [sessionEnd, setSessionEnd] = useState(null);
const [showPassword, setShowPassword] = useState(false);
const [shakeError, setShakeError] = useState(false);
const [showThemeMenu, setShowThemeMenu] = useState(false);
@@ -372,6 +376,11 @@ function LoginPageContent() {
sessionStorage.removeItem('session_expired');
}
} catch { /* sessionStorage unavailable */ }
+ const ended = consumeSessionEnd();
+ if (ended) {
+ setSessionEnd(ended);
+ setSessionExpired(true);
+ }
}, []);
useEffect(() => {
@@ -1269,8 +1278,15 @@ function LoginPageContent() {
' },
+ });
+
+ // The preview fills in sample values and leaves out empty lines.
+ const preview = screen.getByTestId('org-signature-preview');
+ expect(preview.innerHTML).toContain('Alex Example Phone: +49 30 1234567 Mobile: +49 170 1234567');
+ expect(preview.innerHTML).toContain('ACME Ltd');
+ fireEvent.click(screen.getByLabelText('For a user who filled in no details'));
+ expect(screen.getByTestId('org-signature-preview').innerHTML).toContain('
+ {resolved.matched.length === 0
+ ? 'No domain or group applies; this user gets Everyone\'s settings.'
+ : `Applies, in this order: Everyone, ${resolved.matched.map((id) => sourceLabel(id, draft.scopes)).join(', ')}.`}
+
+ {rows.length === 0 ? (
+
Everything is at Bulwark's defaults.
+ ) : (
+
+
+
+
+
Setting
+
Value
+
Set by
+
+
+
+ {rows.map(([path, source]) => (
+
+
{path}
+
{formatValue(valueAt(resolved.policy as unknown as Record, path))}
+
{sourceLabel(source, draft.scopes)}
+
+ ))}
+
+
+
+ )}
+
+ Bulwark can only see groups that have a mailbox: a user counts as a member when the group's account is in their session.
+
+
+ );
+}
+
+/**
+ * The frame of an Organisation page: title and the one sentence on what it
+ * does for users, the scope bar, messages, and the save bar.
+ */
+export function OrgPage({ pageId, draft, children, scoped = true }: {
+ pageId: AdminPageId;
+ draft: OrgPolicyDraft;
+ children: ReactNode;
+ /** Pages whose settings can be set per scope show the scope bar. */
+ scoped?: boolean;
+}) {
+ const page = adminPageDef(pageId);
+ return (
+
+
+ {draft.loading ? (
+
+ Loading
+
+ ) : (
+
+ {scoped && }
+
+ {children}
+
+ )}
+ void draft.save()}
+ onDiscard={draft.discard}
+ saveLabel="Save"
+ note="Users get the change the next time Bulwark loads"
+ />
+
+ );
+}
diff --git a/components/admin/org/policy-file-section.tsx b/components/admin/org/policy-file-section.tsx
new file mode 100644
index 000000000..bbb7e737a
--- /dev/null
+++ b/components/admin/org/policy-file-section.tsx
@@ -0,0 +1,144 @@
+'use client';
+
+import { useRef, useState } from 'react';
+import { Download, Loader2, Upload } from '@/components/icons';
+import { SettingsSection } from '@/components/settings/settings-section';
+import { Button } from '@/components/ui/button';
+import { apiFetch } from '@/lib/browser-navigation';
+import type { KeyChanges, PolicyChangeSummary } from '@/lib/admin/policy-diff';
+import type { OrgPolicyDraft } from './use-org-policy-draft';
+
+function describe(label: string, changes: KeyChanges): string | null {
+ const parts = [
+ changes.added.length ? `${changes.added.length} added` : null,
+ changes.changed.length ? `${changes.changed.length} changed` : null,
+ changes.removed.length ? `${changes.removed.length} removed` : null,
+ ].filter(Boolean);
+ return parts.length ? `${label}: ${parts.join(', ')}` : null;
+}
+
+function summaryLines(summary: PolicyChangeSummary): string[] {
+ return [
+ describe('Domains and groups', summary.scopes),
+ describe('Organisation settings', summary.organisation),
+ describe('Locked and hidden settings', summary.restrictions),
+ describe('Features', summary.features),
+ describe('Defaults for new users', summary.defaults),
+ summary.other.length ? `Also: ${summary.other.join(', ')}` : null,
+ ].filter((line): line is string => !!line);
+}
+
+/**
+ * Export and import of the whole user policy as policy.json, so the policy
+ * can live in git, move to another instance or go next to a Lite build.
+ * An import shows what it changes before it replaces anything.
+ */
+export function PolicyFileSection({ draft }: { draft: OrgPolicyDraft }) {
+ const input = useRef(null);
+ const [pending, setPending] = useState<{ name: string; text: string; summary: PolicyChangeSummary } | null>(null);
+ const [busy, setBusy] = useState(false);
+
+ async function exportFile() {
+ const res = await apiFetch('/api/admin/policy/file');
+ if (!res.ok) {
+ draft.setMessage({ type: 'error', text: 'Could not export the policy' });
+ return;
+ }
+ const blob = await res.blob();
+ const name = /filename="([^"]+)"/.exec(res.headers.get('Content-Disposition') ?? '')?.[1] ?? 'bulwark-policy.json';
+ const url = URL.createObjectURL(blob);
+ const link = document.createElement('a');
+ link.href = url;
+ link.download = name;
+ link.click();
+ URL.revokeObjectURL(url);
+ }
+
+ async function pick(file: File) {
+ setBusy(true);
+ try {
+ const text = await file.text();
+ const res = await apiFetch('/api/admin/policy/file?preview=1', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: text });
+ const data = await res.json().catch(() => ({}));
+ if (!res.ok) {
+ draft.setMessage({ type: 'error', text: data.error || 'Could not read the file' });
+ return;
+ }
+ setPending({ name: file.name, text, summary: data.summary });
+ } finally {
+ setBusy(false);
+ if (input.current) input.current.value = '';
+ }
+ }
+
+ async function apply() {
+ if (!pending) return;
+ setBusy(true);
+ try {
+ const res = await apiFetch('/api/admin/policy/file', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: pending.text });
+ const data = await res.json().catch(() => ({}));
+ if (!res.ok) {
+ draft.setMessage({ type: 'error', text: data.error || 'Could not import the file' });
+ return;
+ }
+ setPending(null);
+ await draft.reload();
+ draft.setMessage({ type: 'success', text: `Imported ${pending.name}.` });
+ } finally {
+ setBusy(false);
+ }
+ }
+
+ return (
+
+
It matches the current policy; nothing would change.
+ ) : (
+
+ {summaryLines(pending.summary).map((line) =>
{line}
)}
+
+ )}
+
+
+
+
+
+ )}
+
+ );
+}
diff --git a/components/admin/org/sections/delegates-section.tsx b/components/admin/org/sections/delegates-section.tsx
new file mode 100644
index 000000000..1fecb99c5
--- /dev/null
+++ b/components/admin/org/sections/delegates-section.tsx
@@ -0,0 +1,34 @@
+'use client';
+
+import { SettingsSection } from '@/components/settings/settings-section';
+import { RESTRICTION_KEYS } from '@/lib/admin/restriction-keys';
+import { RestrictionRow } from '../org-page';
+import type { OrgPolicyDraft } from '../use-org-policy-draft';
+
+const DELEGATION = RESTRICTION_KEYS.find((def) => def.key === 'delegation')!;
+const SHARING_RIGHTS = RESTRICTION_KEYS.find((def) => def.key === 'sharingRights')!;
+
+/** Organisation > Sharing > Delegates: whether users may delegate, and which rights any share dialog offers. */
+export function DelegatesSection({ draft }: { draft: OrgPolicyDraft }) {
+ const rights = draft.restriction(SHARING_RIGHTS.key).value;
+ const noneTicked = Array.isArray(rights?.allowedValues) && rights.allowedValues.length === 0;
+ return (
+
+
+
+ {noneTicked && (
+
+ With neither ticked nothing is limited, so users can give both. Tick "read" to allow read access only.
+
+ )}
+
+ Both limit what Bulwark offers. Stalwart doesn't enforce them, so users can still share through other clients. Shared
+ mailboxes of groups are yours to manage in Stalwart.
+
+
+ );
+}
diff --git a/components/admin/org/sections/external-mail-section.tsx b/components/admin/org/sections/external-mail-section.tsx
new file mode 100644
index 000000000..e77c38efc
--- /dev/null
+++ b/components/admin/org/sections/external-mail-section.tsx
@@ -0,0 +1,184 @@
+'use client';
+
+import { useEffect, useState } from 'react';
+import { Download, Info } from '@/components/icons';
+import { Button } from '@/components/ui/button';
+import { SettingItem, SettingsSection, ToggleSwitch } from '@/components/settings/settings-section';
+import { AdminLink } from '@/components/admin/admin-link';
+import { parseDomainList } from '@/lib/admin/organisation-policy';
+import { toUnicodeDomain } from '@/lib/idn';
+import { apiFetch } from '@/lib/browser-navigation';
+import { EXTERNAL_MAIL_WARNING_PLUGIN_ID } from '@/lib/plugin-sandbox/host-features';
+import { InheritNote } from '../org-page';
+import type { OrgPolicyDraft } from '../use-org-policy-draft';
+
+/** The first release of the plugin core took over from that steps back on its own. */
+export const PLUGIN_STEPS_BACK_FROM = '1.6.0';
+
+function older(version: string, than: string): boolean {
+ const a = version.split(/[-+]/)[0].split('.').map(Number);
+ const b = than.split(/[-+]/)[0].split('.').map(Number);
+ for (let i = 0; i < 3; i++) if ((a[i] || 0) !== (b[i] || 0)) return (a[i] || 0) < (b[i] || 0);
+ return false;
+}
+
+type InstalledPlugin = { version: string };
+
+/** The External Mail Warning plugin when the admin installed it, else null. */
+function useInstalledPlugin(): InstalledPlugin | null {
+ const [plugin, setPlugin] = useState(null);
+ useEffect(() => {
+ let cancelled = false;
+ void (async () => {
+ try {
+ const res = await apiFetch('/api/admin/plugins');
+ const list = res.ok ? ((await res.json()) as Array<{ id: string; version?: string }>) : [];
+ const found = Array.isArray(list) ? list.find((p) => p.id === EXTERNAL_MAIL_WARNING_PLUGIN_ID) : undefined;
+ if (!cancelled) setPlugin(found ? { version: found.version ?? '' } : null);
+ } catch {
+ if (!cancelled) setPlugin(null);
+ }
+ })();
+ return () => { cancelled = true; };
+ }, []);
+ return plugin;
+}
+
+const onOff = (v: boolean) => (v ? 'on' : 'off');
+
+/**
+ * Organisation > Security > External mail: the "External" sender label,
+ * the confirm before sending outside, which domains are internal, and the
+ * hand-over from the External Mail Warning plugin.
+ */
+export function ExternalMailSection({ draft }: { draft: OrgPolicyDraft }) {
+ const senderLabel = draft.orgValue('externalMail', 'senderLabel');
+ const recipientWarning = draft.orgValue('externalMail', 'recipientWarning');
+ const domains = draft.orgValue('externalMail', 'domains');
+ const trustContacts = draft.orgValue('externalMail', 'trustContacts');
+ const plugin = useInstalledPlugin();
+ const anyOn = senderLabel.value || recipientWarning.value;
+
+ // The list is typed as text and taken apart when the field is left, so a
+ // half-typed domain isn't thrown away on every key. It is stored in ASCII
+ // (xn--) form and shown in Unicode; entries that aren't domains are named.
+ const stored = domains.value.join('\n');
+ const joined = domains.value.map(toUnicodeDomain).join('\n');
+ const [text, setText] = useState(joined);
+ const [rejected, setRejected] = useState([]);
+ useEffect(() => { setText(joined); }, [joined]);
+ const commitDomains = (raw: string) => {
+ const parsed = parseDomainList(raw) ?? { domains: [], rejected: [] };
+ setRejected(parsed.rejected);
+ if (parsed.domains.join('\n') !== stored) draft.setOrgValue('externalMail', 'domains', parsed.domains);
+ else setText(joined);
+ };
+
+ const [importing, setImporting] = useState(false);
+ const importFromPlugin = async () => {
+ setImporting(true);
+ try {
+ const res = await apiFetch(`/api/admin/plugins/${EXTERNAL_MAIL_WARNING_PLUGIN_ID}/config`);
+ if (!res.ok) throw new Error(String(res.status));
+ const config = (await res.json()) as Record;
+ const parsed = parseDomainList(config.safeDomains) ?? { domains: [], rejected: [] };
+ const fromPlugin = parsed.domains;
+ setRejected(parsed.rejected);
+ const added = fromPlugin.filter((d) => !domains.value.includes(d));
+ if (added.length > 0) draft.setOrgValue('externalMail', 'domains', [...domains.value, ...added]);
+ draft.setMessage({
+ type: 'success',
+ text: added.length > 0
+ ? `Added ${added.length} ${added.length === 1 ? 'domain' : 'domains'} from the plugin. Save to apply them.`
+ : fromPlugin.length > 0 ? 'The list already has every domain the plugin had.' : 'The plugin has no safe domains set.',
+ });
+ } catch {
+ draft.setMessage({ type: 'error', text: 'Could not read the plugin settings' });
+ } finally {
+ setImporting(false);
+ }
+ };
+
+ const outdated = !!plugin && older(plugin.version, PLUGIN_STEPS_BACK_FROM);
+
+ return (
+
+
+
+ Your users' own domains always count as internal. Add partner or sister-company domains here, one per line or separated by commas. A domain covers its subdomains: example.com also covers eu.example.com.
+