dealerweb
55be19ede7
Feature: admin toggle for search-engine indexing (robots)
...
Add a 'Search Engine Indexing' toggle under Settings -> General. Off (the
default) emits robots noindex/nofollow in the document head - the safe default
for a private webmail; on lets an admin opt the deployment into indexing.
Backed by the existing admin config-manager (SEARCH_ENGINE_INDEXING env var /
admin override / revert), read server-side in the root generateMetadata().
2026-05-31 14:45:32 +02:00
dealerweb
66c5f0f52c
Feature: configurable PWA install screenshots (per-domain)
...
Admins can upload custom mobile/desktop screenshots shown in the browser's
PWA install dialog, replacing the hardcoded Bulwark ones. Two new config keys
(pwaScreenshotMobileUrl/DesktopUrl), upload widgets in the admin Branding tab,
a sharp-based /api/pwa-screenshot/[variant] resize route, and manifest.ts picks
the custom screenshots when configured.
Like the other branding fields, screenshots are per-domain: they are
BRANDING_OVERRIDE_KEYS, the manifest and the /api/pwa-screenshot route resolve
them from the request host (domain override -> global -> Bulwark default), and
the admin Branding tab + upload/delete route handle them in a per-domain scope,
mirroring pwaIconUrl/faviconUrl.
2026-05-30 15:45:59 +02:00
Linus Rath
1da04c254b
feat: per-domain branding overrides on /api/config, manifest, pwa-icon #332
2026-05-28 20:06:47 +02:00
Linus Rath
8ae5ecba41
feat: policy-controlled push relay URL with optional user lock
2026-05-28 19:45:14 +02:00
Linus Rath
63f2169ae7
fix: add OAUTH_ALLOW_PRIVATE_ENDPOINTS for split-DNS setups
2026-05-22 17:22:14 +02:00
Linus Rath
fc5f6f43d6
feat: expose PWA, app identity, and extension directory keys in JSON config #312
2026-05-21 23:35:58 +02:00
Linus Rath
f39366b470
fix: read OAUTH_SCOPES at runtime instead of build time
2026-05-15 20:37:00 +02:00
Linus Rath
51745ea03d
feat: web setup wizard + admin config/state dir split ( #226 )
2026-05-09 17:37:41 +02:00
Linus Rath
d3d79be64c
feat: multi-server JMAP support
2026-05-06 17:33:55 +02:00
Linus Rath
419382d25d
feat: add contacts feature gate and update telemetry payload
2026-04-28 17:54:11 +02:00
Linus Rath
5aa9b1d5f9
fix: honor SESSION_SECRET_FILE in dashboard warning check #222
2026-04-25 17:21:17 +02:00
Linus Rath
6b7c849332
refactor: remove Stalwart API URL configuration
2026-04-21 17:50:18 +02:00
Linus Rath
6ee0f6a40a
feat: disable plugins by default, require admin approval
2026-04-02 13:50:02 +02:00
Linus Rath
a3d894730b
fix: hardened security, CSP enforcement, SSRF redirect validation, reenabled S/MIME chain verify, IP spoofing prevention, PDF iframe sandbox
2026-03-31 15:11:38 +02:00
Linus Rath
99d5276cfa
feat: add support for custom JMAP server endpoints in login and settings
2026-03-29 00:47:35 +01:00
Linus Rath
415c961937
feat: enforce forced/managed plugins and policy. Split user upload permission
2026-03-27 16:33:17 +01:00
Linus Rath
37bc88dbad
feat: implement force enable/disable functionality for plugins and themes
2026-03-26 18:59:30 +01:00
Linus Rath
29a222eef4
feat: add plugin/theme disable gates and move policy controls to their admin pages
...
- Add `pluginsEnabled` and `themesEnabled` master feature gates to FeatureGates
- Move theme policy UI (default theme, built-in/admin theme toggles, user uploads toggle) from policy page to themes admin page
- Add plugin policy UI (plugins enabled toggle) to plugins admin page
- Remove theme policy section and plugin/theme gates from policy page (with note directing to respective pages)
- Hide Themes and Plugins settings tabs when their feature gate is disabled
- Fix dark mode visibility of all admin toggle switches (bg-white → bg-background, increase off-state track opacity)
2026-03-25 00:44:04 +01:00
Linus Rath
76b21147e4
feat: add plugin/theme harness and admin dashboard
...
Plugin & Theme System:
- Add plugin type definitions, permissions (30+), and validation constants
- Add IndexedDB storage layer for plugin code, theme CSS, and previews
- Add theme CSS sanitization, injection, and safety validation
- Add HookBus event system with 130+ hooks across 20 domains
- Add plugin ZIP extraction and manifest validation with JS security checks
- Add sandboxed PluginAPI factory with scoped storage, logging, and permission gating
- Add plugin loader with blob URL dynamic import and auto-disable circuit breaker
- Add 3 built-in themes (Nord, Catppuccin, Solarized)
- Add Zustand plugin store with install/uninstall/enable/disable lifecycle
- Add PluginSlot, PluginSlotRenderer, and PluginErrorBoundary components
- Add plugins and themes settings UI panels
- Integrate plugin slots into email viewer, composer, navigation rail, sidebar, and context menu
- Extend theme store with custom theme installation and activation
Admin Dashboard:
- Add admin authentication with scrypt password hashing and AES-256-GCM sessions
- Add rate-limited login (5 attempts/15min per IP)
- Add config manager with admin override > env var > default priority
- Add settings policy system with feature gates and per-setting restrictions
- Add audit logging with rotation
- Add admin API routes (login, logout, config, policy, audit, password change)
- Add admin UI pages (login, dashboard, config, policy, audit)
- Add policy store for client-side feature gate enforcement
- Wire admin password initialization into server instrumentation
Tests:
- Add 139 tests across 10 test files covering all plugin/theme modules
2026-03-25 00:44:03 +01:00
dealerweb
Linus Rath