Linus Rath e720be7e17 feat: let users install their own plugins, with admin review of the actual code ...

The admin page offered "User Plugin Uploads" and "Require Admin
Approval", but nothing in Settings used them: there was no upload, no
uninstall and no way to ask for approval, and the admin had no list of
requests. The approval code that existed pinned a hash of the code only
and showed the admin a manifest the browser sent, never the code.

Now:
- Settings > Plugins has an install button (when uploads are allowed),
  a remove button for the user's own plugins, and lists in plain
  language what each plugin may do, high-risk items first
- an install sends the ZIP to the server, which reads the manifest and
  code itself and pins the request to a hash of both
- the admin Plugins tab lists requests with the code and approves or
  denies them; a user may have 10 open requests
- a user plugin is checked again on every start, so a revoked approval
  or turning user plugins off takes effect
- the consent dialog and the plugin settings are translated, use the
  theme colours, and show the sites a plugin may send data to

2026-10-14 02:03:26 +02:00

..

fixtures

feat: remember every sign-in unless the admin shows the remember me box

2026-10-13 13:13:56 +02:00

helpers

test: add characterisation tests for untested integration seams

2026-06-19 23:52:42 +02:00

account-archive-route.test.ts

feat: optional encrypted backup of the account list

2026-10-09 10:54:38 +02:00

account-archive.test.ts

feat: optional encrypted backup of the account list

2026-10-09 10:54:38 +02:00

account-inbox-unread.test.ts

feat: add Mountain View, an optional alternative layout

2026-10-05 10:36:20 +02:00

account-ordering.test.ts

feat(accounts): pin default account on top + drag-to-reorder switcher

2026-07-04 14:51:46 +02:00

account-state-manager.test.ts

fix: scope batch selection to the owning account

2026-09-19 08:59:21 +02:00

account-utils-http2.test.ts

fix: detect HTTP/2 from the initial navigation timing so accounts aren't capped at five

2026-09-10 10:14:25 +02:00

admin-auth-stalwart-access.test.ts

fix: ignore admin status from a server the admin never configured (GHSA-j867-89p4-v8hm)

2026-09-26 14:20:36 +02:00

admin-rate-limit.test.ts

fix: cap admin sign-in attempts across all clients (GHSA-7pj2-232x-6698)

2026-09-26 15:07:09 +02:00

admin-session-cookie-secure.test.ts

fix: let COOKIE_SECURE decide the admin cookie's Secure flag #1063

2026-09-30 14:21:46 +02:00

api-routes-same-origin.test.ts

fix: reject cross-origin writes to the JMAP passthrough and other cookie-authed routes (GHSA-9mvj-98f5-9q6g)

2026-09-26 14:08:44 +02:00

app-frame-origins.test.ts

fix: keep sibling subdomains from widening the sidebar-app frame-src

2026-09-26 16:27:03 +02:00

attachment-visibility.test.ts

fix: hide body-embedded cid parts declared as octet-stream from the attachment list

2026-09-10 10:45:45 +02:00

auth-crypto.test.ts

fix: bind a purpose into encrypted payloads (GHSA-cqqx-mjcf-mh55)

2026-09-17 20:16:51 +02:00

auth-routes-credential-check.test.ts

fix: explain why calendar subscriptions fail with not authenticated #1073

2026-09-23 18:31:27 +02:00

auth-routes-same-origin.test.ts

fix: link the mobile app from every account with a sign-in of its own

2026-09-27 04:16:18 +02:00

auth-verify-route.test.ts

fix: limit wrong passwords tried through the login pre-check

2026-09-26 16:36:58 +02:00

base-path.test.ts

fix: strip build-time basePath from router.push redirects after login #390

2026-06-12 00:23:00 +02:00

birthday-calendar.test.ts

test: add characterisation tests for untested integration seams

2026-06-19 23:52:42 +02:00

branding-asset.test.ts

fix: pin resolved IP for stored custom JMAP endpoints and branding URLs

2026-08-26 23:02:19 +02:00

builtin-themes.test.ts

feat: add "Flat fields" theme

2026-09-19 13:01:07 +02:00

bundle-integrity.test.ts

fix(): refill missing managed bundles from the server #636

2026-09-07 16:52:20 +02:00

bundle-signing.test.ts

fix(): refill missing managed bundles from the server #636

2026-09-07 16:52:20 +02:00

caldav-discover-route.test.ts

test: add characterisation tests for untested integration seams

2026-06-19 23:52:42 +02:00

calendar-agenda-route.test.ts

fix: show shared and group calendars in the Calendar Agenda

2026-10-06 06:24:17 +02:00

calendar-alerts.test.ts

feat: start new events on the calendar's default reminders #1209

2026-10-13 15:56:10 +02:00

calendar-collection-dav.test.ts

fix: pin supported-calendar-component-set on created calendars #760

2026-08-25 19:16:20 +02:00

calendar-component-detection.test.ts

fix(calendar): hide tasks-only calendars from the event calendar UI

2026-08-16 21:18:57 +02:00

calendar-display-range.test.ts

feat: limit the day and week views to working hours and days #1164

2026-10-02 22:56:16 +02:00

calendar-duplicate.test.ts

fix: keep the meeting link when duplicating an event #1170

2026-10-05 23:09:48 +02:00

calendar-editability.test.ts

fix: rsvp controls

2026-09-03 22:12:15 -07:00

calendar-event-normalization.test.ts

fix: JSCalendar 2.0 recurrenceRule single-object compatibility 116

2026-03-31 00:11:04 +02:00

calendar-invitation.test.ts

feat: add calendar event normalization and sanitization functions with tests

2026-03-27 18:46:20 +01:00

calendar-participants.test.ts

Merge pull request #748 from lucletoffe/fix/calendar-blank-cn-and-description

2026-09-30 14:21:20 +02:00

calendar-scroll-window.test.ts

feat: setting to turn off free scrolling in the calendar

2026-09-09 18:27:01 +02:00

calendar-tasks.test.ts

feat: show tasks with due dates in the calendar month view #1107

2026-09-26 20:47:13 +02:00

calendar-utils.test.ts

fix: repair pre-existing failing vitest suite

2026-06-19 23:53:20 +02:00

clear-cached-data.test.ts

fix: route multi-account email lookups and invitation parsing by source account #847

2026-08-25 18:50:50 +02:00

color-transform.test.ts

fix: recolour mails for dark mode instead of inverting them

2026-10-11 18:43:04 +02:00

config-route.test.ts

feat: remember every sign-in unless the admin shows the remember me box

2026-10-13 13:13:56 +02:00

config-validation.test.ts

fix: recover from transient application configuration failures

2026-09-27 15:41:21 +08:00

connector-registry.test.ts

feat: resolve deep links to the local instance

2026-09-20 19:59:37 +02:00

contact-wire.test.ts

fix: save contacts with calendar links and cleared fields correctly

2026-09-22 20:37:16 +02:00

csp-frame-origins.test.ts

feat: composer-sidebar slot + plugin-declared frame-src origins

2026-04-25 18:40:54 +02:00

deep-link-handoff.test.ts

feat: open global search hits through the owning login on every surface #847

2026-09-01 20:55:13 +02:00

deep-links.test.ts

fix: open the inbox instead of the last folder when the app starts

2026-10-02 16:31:44 +02:00

dev-jmap-mock.test.ts

fix: keep the mock JMAP server out of release builds

2026-09-26 17:07:31 +02:00

domain-branding.test.ts

fix: use callable .get to detect Headers in pickRequestHost

2026-07-09 13:51:12 +02:00

download-filename.test.ts

fix: never loop forever when deduping drag-out .eml names #1039

2026-09-17 21:42:16 +02:00

email-body-selection.test.ts

fix: take a re-opened draft's body from its body parts only

2026-10-11 18:04:26 +00:00

email-composer-utils.test.ts

fix: stop a quoted sender name from adding a recipient to a draft

2026-09-26 15:48:27 +02:00

email-dark-mode.test.ts

fix: stop painting plain mails on a gray background in dark mode

2026-10-11 22:19:05 +02:00

email-date.test.ts

fix: parse calendar invitations in directly viewed shared folders against the folder owner #867

2026-08-25 19:36:04 +02:00

email-fit-width.test.ts

fix: wrap text in fixed-width tables to the screen on iOS #1020

2026-09-23 19:41:44 +02:00

email-headers.test.ts

feat: warn when a message's sender can't be verified

2026-10-07 19:04:15 +02:00

email-link-targets.integration.test.ts

fix: treat image-map links like anchors so they cannot keep the opener

2026-09-26 14:53:40 +02:00

email-sanitization.test.ts

fix: recolour mails for dark mode instead of inverting them

2026-10-11 18:43:04 +02:00

email-threading.test.ts

fix: set In-Reply-To and References on replies #234

2026-04-30 01:25:04 +02:00

eml-import.test.ts

test: add characterisation tests for untested integration seams

2026-06-19 23:52:42 +02:00

event-end-follows-start.test.ts

feat(calendar): move the end with the start, keeping the event's length

2026-08-13 21:24:09 +02:00

event-links.test.ts

fix(calendar): keep app-scheme meeting links and match service labels exactly

2026-09-24 10:00:01 +02:00

extension-package.test.ts

fix: check plugin and theme packages the same way on every install path

2026-10-14 01:43:43 +02:00

favicon-badge.test.ts

feat: redesign the unread favicon badge as a compact keyline badge

2026-08-20 16:49:31 +02:00

favicon-route-types.test.ts

fix: serve sender favicons only as inert raster images

2026-09-26 16:24:11 +02:00

fetch-ical-route.test.ts

fix: reject cross-origin writes to the JMAP passthrough and other cookie-authed routes (GHSA-9mvj-98f5-9q6g)

2026-09-26 14:08:44 +02:00

file-name-rules.test.ts

fix: handle the file names and types Stalwart refuses

2026-09-22 20:54:01 +02:00

file-preview.test.ts

fix: preview audio, video and icon attachments sent with a catch-all type

2026-09-30 15:08:31 +02:00

filenode-name.test.ts

fix: decode percent-encoded FileNode names from WebDAV-created nodes #869

2026-08-25 18:47:22 +02:00

format-file-size.test.ts

fix: round file sizes to what people read, like 67 KB or 2.1 MB

2026-10-11 16:53:49 +02:00

format-relative-ago.test.ts

feat: give Mountain View's open message Gmail's toolbar, pager and header

2026-10-12 01:10:10 +02:00

forward-as-attachment.test.ts

fix: avoid leaving TZ="undefined" when restoring an unset timezone

2026-07-29 13:31:56 +12:00

health-route.test.ts

fix: enhance health check functionality with detailed memory diagnostics and stable liveness probe

2026-03-19 18:50:59 +01:00

host-theme.test.ts

fix: theme plugin slot iframes with host font + color tokens

2026-05-31 16:28:22 +02:00

html-to-text.test.ts

fix: mark quotes and list items in the plain-text part of sent mail

2026-10-11 20:00:47 +02:00

idn.test.ts

fix: sign in and show addresses on internationalized domains #1100

2026-09-24 21:15:22 +02:00

impersonation-jwt.test.ts

feat: expose PWA, app identity, and extension directory keys in JSON config #312

2026-05-21 23:35:58 +02:00

impersonation-master-config.test.ts

fix: read impersonation secrets from *_FILE when the variable is empty #897

2026-09-30 14:23:09 +02:00

impersonation-replay-store.test.ts

fix: refuse a used impersonation link after a restart or on another replica

2026-09-26 16:34:58 +02:00

impersonation-session.test.ts

fix: refuse a used impersonation link after a restart or on another replica

2026-09-26 16:34:58 +02:00

instance-details-gates.test.ts

fix: stop handing instance details to visitors who are not signed in

2026-09-26 17:03:24 +02:00

instance-details.test.ts

fix: stop handing instance details to visitors who are not signed in

2026-09-26 17:03:24 +02:00

ios-input-zoom.test.ts

fix: iOS Safari zooms the viewport on every input focus #838

2026-08-16 23:02:27 +02:00

ios-viewport-heal.test.ts

fix: restore the full screen height when the iOS app resumes #1226

2026-10-13 14:53:23 +02:00

jitsi-plugin.test.ts

feat: implemented plugin configuration UI and calendar event action slot

2026-03-30 21:12:05 +02:00

jmap-all-calendars-failures.test.ts

fix: keep calendars visible after a failed calendar fetch

2026-09-29 23:59:03 +02:00

jmap-calendar-access.test.ts

Fix: stop re-probing shared accounts without calendar access

2026-07-23 14:55:34 +02:00

jmap-calendar-batch-failures.test.ts

fix: report calendar clear failures instead of counting zero #434

2026-09-07 22:34:47 +02:00

jmap-calendar-capability.test.ts

fix: check the specific capability a request declares, not a broader one

2026-08-12 17:34:20 +03:00

jmap-calendar-default-alerts.test.ts

feat: add helpers for calendar default alerts and email alert rows #1209

2026-10-13 15:56:09 +02:00

jmap-calendar-query-range.test.ts

fix: query calendar ranges in the right time zone and past the limits

2026-09-22 20:42:07 +02:00

jmap-calendar-scheduling.test.ts

fix: offer to save an event when the server refuses its invitations

2026-09-22 21:25:20 +02:00

jmap-calendar-synthetic-ids.test.ts

feat: let attendees answer a single occurrence of a recurring event #1086

2026-09-23 13:06:41 +02:00

jmap-calendar-task-progress.test.ts

fix: normalize calendar task progress states

2026-09-08 23:19:24 +09:00

jmap-calendar-tasks.test.ts

fix: let tasks move into and live in calendars shared with you #1204

2026-10-12 07:36:46 +02:00

jmap-client-extensions.test.ts

feat: offer deleting a non-empty folder with its messages

2026-08-29 18:23:09 +02:00

jmap-client-poll-batching.test.ts

fix: split the state poll to fit the server's call limit

2026-09-26 15:39:48 +02:00

jmap-client-resilience.test.ts

test: expect session URLs hosted on another origin to be kept

2026-10-01 00:36:00 +02:00

jmap-contact-client.test.ts

feat: allow setting an address book as default (#924)

2026-08-29 17:15:50 +02:00

jmap-contacts-capability.test.ts

fix: check the specific capability a request declares, not a broader one

2026-08-12 17:34:20 +03:00

jmap-create-calendar-caldav.test.ts

fix: pin supported-calendar-component-set on created calendars #760

2026-08-25 19:16:20 +02:00

jmap-cross-account-move.test.ts

fix: keep a copied message's original date in the other account #1150

2026-10-02 10:35:09 +02:00

jmap-delayed-send-limit.test.ts

fix: cap scheduled send at the 7 days Stalwart actually accepts

2026-09-22 20:31:53 +02:00

jmap-draft-lifecycle.test.ts

fix: remove the unsent copy from Drafts when a send fails

2026-10-11 19:09:11 +02:00

jmap-email-set-failures.test.ts

fix: surface Email/set failures on delete and move #956

2026-09-07 22:34:47 +02:00

jmap-empty-mailbox.test.ts

fix: move mail to trash when emptying an ordinary folder

2026-09-29 20:35:09 +02:00

jmap-file-capability.test.ts

fix: hide Files when account lacks filenode capability #563

2026-07-07 23:59:19 +02:00

jmap-file-share.test.ts

fix: check the specific capability a request declares, not a broader one

2026-08-12 17:34:20 +03:00

jmap-filenode-client.test.ts

fix: list every file when the account exceeds maxObjectsInGet #1069

2026-09-22 00:17:44 +02:00

jmap-filenode-writes.test.ts

fix: share files on Stalwart versions before 0.16.6

2026-09-22 20:49:44 +02:00

jmap-first-touch-ordering.test.ts

feat: use Stalwart synthetic ids for recurring occurrences #140

2026-08-29 11:03:48 +02:00

jmap-identity-client.test.ts

feat: add contacts phase 2, advanced search, vacation responder, Docker & TOTP 2FA

2026-02-16 18:51:30 +01:00

jmap-imip-message-id.test.ts

fix: set the sender's Message-ID on calendar invitations and replies

2026-10-13 16:32:25 +02:00

jmap-keyword-account.test.ts

fix: flip $junk/$notjunk keywords on spam and not-spam #850

2026-08-25 19:36:52 +02:00

jmap-keyword-discovery.test.ts

refactor: generalize JMAP keyword capability

2026-08-12 22:47:00 +08:00

jmap-keyword-pointer.test.ts

fix(jmap): escape the JSON Pointer in keyword patches, and migrate a keyword honestly

2026-08-18 08:15:22 +05:00

jmap-list-order.test.ts

fix: sort the message list by date sent when that order is picked #1219

2026-10-12 07:22:00 +02:00

jmap-mailbox-account.test.ts

fix: subscribe newly created mailboxes #951

2026-09-07 22:34:47 +02:00

jmap-mark-read-paging.test.ts

fix: mark every unread message read and report refused spam moves

2026-09-22 21:00:10 +02:00

jmap-method-errors.test.ts

fix: show why the server refused a sent message instead of a dangling reference error

2026-10-02 22:02:50 +02:00

jmap-passthrough.test.ts

feat: migrate Stalwart management API to JMAP x: methods (0.16)

2026-04-21 17:29:23 +02:00

jmap-principals-paging.test.ts

fix: list sharing principals in directories with more than 500 users

2026-09-22 21:14:05 +02:00

jmap-recipient-mailboxes.test.ts

fix: split "Name <addr>" recipients into the JMAP name and email fields #672

2026-08-06 19:19:18 +02:00

jmap-request-limits.test.ts

fix: leave trash and spam out of tag views and their counts #1156

2026-10-02 23:15:26 +02:00

jmap-send-envelope.test.ts

fix: use the from override as envelope sender where the server allows it #1009

2026-09-23 19:58:26 +02:00

jmap-send-rejected-recipients.test.ts

fix: remove the unsent copy from Drafts when a send fails

2026-10-11 19:09:11 +02:00

jmap-send-threading.test.ts

fix(jmap): file post-send message with a full mailboxIds replacement

2026-07-16 17:58:19 +02:00

jmap-session-redirect-401.test.ts

fix: retry the JMAP session fetch when a redirect drops the auth header #892

2026-09-07 22:34:47 +02:00

jmap-truncated-body.test.ts

fix(email): refetch body value when JMAP truncates the displayed part

2026-09-02 08:34:31 +02:00

jmap-update-mailboxes.test.ts

feat: move several folders at once from the folder settings #1173

2026-10-06 15:49:53 +02:00

keyboard.test.ts

fix: detect typing inside the QuotedHtml shadow island via composedPath #654

2026-07-21 23:26:51 +02:00

keyword-discovery.test.ts

feat: detect and import unrecognized JMAP keywords as tags #658

2026-08-06 18:44:14 +02:00

keyword-format.test.ts

feat: Add nesting of tags in a tree

2026-07-29 17:18:38 +02:00

keyword-nesting.test.ts

feat: allow hidden tags, either permanent or when there are no unread messages

2026-07-29 17:18:42 +02:00

layout-link-preview.test.ts

feat: add "Flat fields" theme

2026-09-19 13:01:07 +02:00

layout-theme-color.test.ts

feat: add "Flat fields" theme

2026-09-19 13:01:07 +02:00

list-attachments.test.ts

fix: keep message list from jumping while attachment chips load

2026-09-26 20:24:23 +02:00

lite-config.test.ts

feat: remember every sign-in unless the admin shows the remember me box

2026-10-13 13:13:56 +02:00

lite-link-segments.test.ts

feat: add Bulwark Lite static export build

2026-09-17 23:54:33 +02:00

lite-mounted-href.test.ts

feat: add Bulwark Lite build for Stalwart Applications

2026-09-19 00:53:53 +02:00

lite-oauth.test.ts

feat: add OpenID Connect login to the Stalwart Lite bundle

2026-09-21 23:45:08 +02:00

lite-scripts.test.ts

fix: point Stalwart installs at a tagged Lite release and publish checksums

2026-09-26 17:30:47 +02:00

lite-stalwart-runtime.test.ts

feat: add Bulwark Lite build for Stalwart Applications

2026-09-19 00:53:53 +02:00

lite-static-params.test.ts

feat: add Bulwark Lite static export build

2026-09-17 23:54:33 +02:00

lite-tokens.test.ts

fix: reuse cached access token on lite session restore #552

2026-09-29 21:25:02 +02:00

mailbox-deep-nesting.test.ts

fix: folders containing a system folder name disappear from the sidebar #771

2026-08-16 22:11:26 +02:00

mailbox-label.test.ts

fix: localize special-folder names by JMAP role #404

2026-06-24 19:32:13 +02:00

mailbox-path.test.ts

fix: use canonical INBOX in Sieve filter paths #313

2026-05-22 11:51:25 +02:00

mailto.test.ts

feat: email a contact or group via the in-app composer

2026-06-19 12:29:43 +02:00

mdn-header-injection.test.ts

fix: strip CR/LF from read-receipt header values (GHSA-w38p-hpqv-g89c)

2026-09-17 20:55:39 +02:00

mdn.test.ts

test: add characterisation tests for untested integration seams

2026-06-19 23:52:42 +02:00

message-list-order.test.ts

fix: keep an opened mail in place in unread-first lists until another is opened

2026-09-29 20:28:39 +02:00

message-list-tabs-store.test.ts

feat: add message-list category tabs

2026-07-22 17:22:20 +02:00

move-targets.test.ts

fix: offer the shared account's folders first when moving its mail #1149

2026-10-02 23:04:28 +02:00

native-select-options.test.ts

fix: keep the group labels of native option lists readable in dark themes

2026-10-01 17:31:59 +02:00

next-config-cors.test.ts

fix: allow sandbox chunk loading with CORS #922

2026-09-09 01:29:25 +09:00

oauth-discovery-base.test.ts

fix(oauth): normalize the discovery base so a session JMAP_SERVER_URL refreshes (#971)

2026-09-08 19:17:18 +00:00

oauth-discovery-validator.test.ts

fix: accept oauth endpoints on the configured issuer's own host #1028

2026-09-23 19:26:07 +02:00

oauth-discovery.test.ts

fix(oauth): harden OIDC discovery (timeout, retry, serve-stale)

2026-07-16 17:56:19 +02:00

oauth-issuer-precedence.test.ts

fix: use the selected server's issuer for SSO discovery #952

2026-09-07 22:34:47 +02:00

oauth-metadata-route.test.ts

fix: discover OIDC metadata server-side to avoid CORS failures #382

2026-06-02 00:15:50 +02:00

oauth-pkce.test.ts

feat(auth): add RP-initiated logout and OAuth unit tests

2026-02-26 00:08:57 +01:00

oauth-token-exchange.test.ts

fix: refresh TOTP-minted tokens with the default client id when no OAuth client is configured #873

2026-08-20 13:59:57 +02:00

oauth-token-route.test.ts

fix: never follow redirects on OAuth token and revocation requests

2026-09-26 15:13:41 +02:00

og-image-route.test.ts

fix: don't export OG_WIDTH/OG_HEIGHT from the og-image route

2026-08-17 00:18:59 +02:00

pair-attempts.test.ts

fix: limit pairing password attempts per mail account and per day

2026-09-27 04:49:03 +02:00

pair-bundle.test.ts

fix: link the mobile app from every account with a sign-in of its own

2026-09-27 04:16:18 +02:00

pair-create-route.test.ts

fix: say up front when the mobile app cannot use an http mail server

2026-09-27 04:53:49 +02:00

pair-oauth-discovery-scopes.test.ts

fix: link the mobile app from every account with a sign-in of its own

2026-09-27 04:16:18 +02:00

pair-reauth-proof.test.ts

fix: link the mobile app from every account with a sign-in of its own

2026-09-27 04:16:18 +02:00

pair-reauth-sso-complete.test.ts

fix: refuse a pairing re-auth the identity provider did not make fresh

2026-09-27 04:49:54 +02:00

pair-redeem-status-route.test.ts

fix: link the mobile app from every account with a sign-in of its own

2026-09-27 04:16:18 +02:00

pair-sso-start-reauth.test.ts

fix: link the mobile app from every account with a sign-in of its own

2026-09-27 04:16:18 +02:00

pair-store.test.ts

fix: clean up after pairings a phone never completes

2026-09-27 04:51:30 +02:00

pair-token-route.test.ts

fix: re-check a paired phone's token endpoint against the current config

2026-09-27 04:50:38 +02:00

plugin-api-gates.test.ts

fix: make label reordering atomic

2026-08-13 21:17:05 +08:00

plugin-bundle-fetch.test.ts

fix(): refill missing managed bundles from the server #636

2026-09-07 16:52:20 +02:00

plugin-hook-permissions.test.ts

fix: require manifest permissions for plugin hooks and slots

2026-09-26 14:26:33 +02:00

plugin-hooks.test.ts

fix: close the composer after a plugin send and keep the draft when it fails #1207

2026-10-11 17:44:26 +02:00

plugin-host-bridge-origin.test.ts

fix: keep plugin network access to the origins in its manifest

2026-10-14 01:27:02 +02:00

plugin-http-fetch.test.ts

fix: keep plugin network access to the origins in its manifest

2026-10-14 01:27:02 +02:00

plugin-http-post-denied-paths.test.ts

fix: keep the plugin denylist and unit tests from breaking Lite and Docker builds

2026-09-26 21:38:57 +02:00

plugin-loader.test.ts

fix: repair pre-existing failing vitest suite

2026-06-19 23:53:20 +02:00

plugin-sandbox-loader.test.ts

fix(): refill missing managed bundles from the server #636

2026-09-07 16:52:20 +02:00

plugin-sandbox-route-gate.test.ts

fix: keep plugin network access to the origins in its manifest

2026-10-14 01:27:02 +02:00

plugin-sandbox-runtime-host-gate.test.ts

fix: bind the plugin sandbox to its framing window (GHSA-96cx-gx36-3g79)

2026-09-17 20:31:39 +02:00

plugin-search-run.test.ts

feat: let plugins run a message-list search with a JMAP filter #1024

2026-10-11 19:39:58 +02:00

plugin-slot-props.test.ts

fix: give slot plugins the message, event or contact only with the matching read permission

2026-10-14 01:31:30 +02:00

plugin-slot.test.tsx

chore: remove unused exports and the dead plugin error boundary

2026-10-13 13:36:51 +02:00

plugin-storage-blocked.test.ts

fix: fail fast when the plugin storage database is blocked #840

2026-09-07 22:34:47 +02:00

plugin-storage-scope.test.ts

fix: keep plugin storage per account and delete it on sign-out

2026-09-26 16:47:29 +02:00

plugin-storage.test.ts

feat: add plugin/theme harness and admin dashboard

2026-03-25 00:44:03 +01:00

plugin-store.test.ts

feat: let users install their own plugins, with admin review of the actual code

2026-10-14 02:03:26 +02:00

plugin-types.test.ts

feat(plugins): add new contact-cryptokeys UI slot

2026-07-24 18:10:37 +02:00

plugin-upload-progress.test.ts

feat: real byte progress for attachment uploads, stock and plugin-offloaded

2026-08-23 19:44:56 +06:00

plugin-validator.test.ts

feat: add Theme API v2 with token compiler, skin slot

2026-04-28 15:39:13 +02:00

pointer-cursor.test.ts

fix: show the pointer cursor on buttons and other controls

2026-10-06 21:31:11 +02:00

preview-leading-css.test.ts

fix: keep previews that only start like a style sheet #1136

2026-10-01 11:02:26 +02:00

protocol-handlers.test.ts

Feature/protocol handlers

2026-05-12 20:49:05 +02:00

proxy-forwarded-headers.test.ts

fix: keep basePath when normalizing Chinese Accept-Language

2026-08-29 12:35:38 +02:00

proxy-security-headers.test.ts

fix: stop not-found pages outside the app tree from being framed

2026-09-26 16:22:49 +02:00

push-bindings.test.ts

perf(push): reconcile push bindings instead of rebuilding them

2026-09-30 19:03:34 +02:00

push-preview-route.test.ts

fix: preview the named message when the inbox lookups beside it fail #1041

2026-10-02 10:32:22 +02:00

push-relays.test.ts

feat: pick push relay from admin-defined list instead of a URL field

2026-08-16 23:04:22 +02:00

quote-collapse.test.ts

feat: collapse quoted reply text behind a "..." toggle #480

2026-07-22 19:17:23 +02:00

quote-header.test.ts

fix: HTML-escape sender/subject in reply/forward quote header (#482)

2026-06-25 00:25:28 +02:00

recipient-mentions.test.ts

feat: mention a recipient by first name with @ in the message body

2026-09-30 22:43:59 +02:00

recurrence-dst-gap.test.ts

fix: keep daily recurring events going past a DST gap

2026-09-26 15:45:59 +02:00

recurrence-expansion.test.ts

fix: keep single-occurrence edits on that occurrence and keep its details

2026-09-23 13:40:01 +02:00

recurrence-instances.test.ts

fix: keep single-occurrence edits on that occurrence and keep its details

2026-09-23 13:40:01 +02:00

recurrence-rule.test.ts

fix(calendar): drop default SKIP=OMIT from recurrence rules (DAVx5 sync)

2026-08-25 21:13:34 +02:00

reply-identity.test.ts

feat: choose exact-address or same-domain matching for reply from received address #1000

2026-09-09 19:27:08 +02:00

reply-recipients.test.ts

fix(reply): honour an external Reply-To even on a self-sent message

2026-08-16 21:12:21 +02:00

request-protocol.test.ts

fix: derive the admin cookie's Secure flag from the request

2026-09-19 11:19:35 +02:00

rfc5322-mailbox.test.ts

fix: split "Name <addr>" recipients into the JMAP name and email fields #672

2026-08-06 19:19:18 +02:00

schedule-presets.test.ts

feat: offer one-click times in the Schedule send dialog

2026-10-11 20:03:42 +02:00

scheduled-send-label.test.ts

fix: show the scheduled time rounded to the minute and with its date

2026-10-11 19:50:40 +02:00

search-scope-folders.test.ts

feat: show the folder hierarchy in the search folder dropdown

2026-09-29 20:15:14 +02:00

search-snippet.test.ts

feat: highlight search hits with SearchSnippet/get

2026-08-29 17:47:23 +02:00

search-suggestions.test.ts

feat: search suggestions with recent searches and contact autocomplete #845

2026-08-25 20:09:18 +02:00

search-utils.test.ts

fix: send mail search terms as typed instead of with a fake prefix wildcard

2026-09-22 21:04:18 +02:00

server-fetch.test.ts

fix: pin resolved IP for stored custom JMAP endpoints and branding URLs

2026-08-26 23:02:19 +02:00

session-cookie.test.ts

test: add characterisation tests for untested integration seams

2026-06-19 23:52:42 +02:00

session-secret-generate.test.ts

feat: generate a session secret on first start when none is configured

2026-10-13 13:17:34 +02:00

settings-route-account-key.test.ts

fix: key synced settings on the account a bearer token belongs to

2026-09-26 14:59:55 +02:00

settings-route-template-merge.test.ts

fix: stop stale tabs and devices from dropping synced templates

2026-10-06 22:14:29 +02:00

settings-search.test.ts

fix: index newer settings and flat calendar toggles in the settings search

2026-09-09 18:40:15 +02:00

setup-url-token.test.ts

fix: keep the setup token out of access logs, referers and history

2026-09-26 16:32:38 +02:00

shared-calendar-colors.test.ts

Feature: per-viewer colors for shared calendars (#345)

2026-05-31 15:52:27 +02:00

sidebar-apps.test.ts

refactor: migrate icon set from Lucide to Tabler Icons

2026-09-19 13:32:41 +02:00

sieve-generator.test.ts

feat: Enhance external rule handling in Sieve parser and store #201

2026-04-16 17:22:52 +02:00

sign-out-cleanup.test.ts

fix: clear the accounts' leftovers when everyone signs out

2026-09-26 16:55:34 +02:00

signature-append.test.ts

fix: sync identity stores and append signatures to outgoing emails (#15)

2026-03-15 16:07:45 +01:00

signature-utils.test.ts

fix: show one signature separator and keep its trailing space

2026-10-11 19:41:48 +02:00

sso-complete-route.test.ts

fix: stop a sixth sso account from overwriting the first account's sign-in

2026-09-30 19:31:03 +02:00

sso-start-route.test.ts

fix: re-authenticate against the account's own server when linking the mobile app

2026-09-23 18:35:15 +02:00

stalwart-jmap-api.test.ts

fix: preserve POST across redirects in Stalwart JMAP passthrough #627

2026-07-16 22:51:07 +02:00

stalwart-jmap-route.test.ts

feat: add a server-side switch for the Stalwart JMAP passthrough #904

2026-09-07 22:34:47 +02:00

stalwart-principal.test.ts

fix: let non-admin users see their name and change a TOTP password

2026-09-22 20:28:01 +02:00

sub-addressing.test.ts

feat: allow custom sub-addressing delimiter character #239

2026-05-01 01:48:39 +02:00

subject-prefix.test.ts

fix: keep the fresh-compose tab title clear of the selected email subject

2026-08-18 15:48:05 +02:00

sw-push-quiet-window.test.ts

fix: keep ringing for a second mail in the same account #1141

2026-10-01 11:02:39 +02:00

tab-title.test.ts

feat: let operators keep the message subject out of the tab title

2026-10-07 08:26:51 +03:00

telemetry-endpoint-guard.test.ts

fix: close IPv6 transition-address and redirect bypasses in endpoint guard

2026-08-25 20:50:35 +02:00

telemetry-fetch-target.test.ts

fix: check telemetry targets at connect time and fail closed

2026-09-26 15:15:23 +02:00

template-sync.test.ts

fix: include email templates in cross-device settings sync #825

2026-08-16 02:09:38 +02:00

template-utils.test.ts

fix: keep already written text when applying a template in compose #540

2026-08-16 22:20:49 +02:00

theme-color-meta.test.ts

fix: sync PWA title bar colour with the active theme #671

2026-08-06 18:23:21 +02:00

theme-compiler.test.ts

feat: add Theme API v2 with token compiler, skin slot

2026-04-28 15:39:13 +02:00

theme-loader.test.ts

fix: close theme CSS sanitizer bypasses and enforce :root/.dark selectors

2026-09-26 14:36:02 +02:00

theme-store-sync.test.ts

fix: install Theme API v2 themes and their skins from the admin page and the marketplace

2026-10-14 01:47:58 +02:00

thread-routing.test.ts

fix: open right conversations in shared mailbox #814

2026-08-16 02:19:04 +02:00

thread-utils.test.ts

fix: keep an opened mail in place in unread-first lists until another is opened

2026-09-29 20:28:39 +02:00

timezone.test.ts

feat: draw Mountain View's message rows like Gmail's

2026-10-12 01:01:09 +02:00

tnef.test.ts

chore: write nul separators as \0 so git diffs these files as text

2026-09-30 19:34:37 +02:00

totp-issuer.test.ts

fix: keep Stalwart as the authenticator entry name on unbranded installs #1177

2026-10-06 23:29:42 +02:00

totp-token-exchange-detail.test.ts

fix: stop sending the webmail's OAuth client secret to user-chosen mail servers

2026-09-27 04:12:47 +02:00

translate-route.test.ts

fix: require a session for the translate API #903

2026-09-07 22:34:47 +02:00

translations.test.ts

fix: scope separate translation hooks instead of relative namespace paths

2026-08-12 17:53:35 +03:00

unified-accounts-grew.test.ts

fix(mail): unified mailbox missed accounts that had not connected yet

2026-09-02 22:15:50 +02:00

unified-load-progress.test.ts

feat(unified): say how many accounts the unified mailbox holds while logins reconnect

2026-10-01 04:38:04 +02:00

unified-mailbox-cross.test.ts

fix: include sent mail when searching from unified all mail

2026-10-07 19:28:44 +02:00

unified-mailbox-search-accounts.test.ts

feat: leave spam and trash out of search by default

2026-09-29 19:52:39 +02:00

unified-mailbox-tags.test.ts

fix: leave trash and spam out of tag views and their counts #1156

2026-10-02 23:15:26 +02:00

unified-mailbox.test.ts

fix: stop unified-mailbox from mutating client-returned email objects

2026-06-25 00:25:00 +02:00

unified-paging-positions.test.ts

fix: page each account of a merged list from its own position

2026-09-26 15:43:32 +02:00

upload-progress.test.ts

feat: real byte progress for attachment uploads, stock and plugin-offloaded

2026-08-23 19:44:56 +06:00

url-guard-connect-pin.test.ts

fix: pin resolved IP at connect time to block DNS-rebinding SSRF (GHSA-24w9-8r42-8jwm)

2026-08-26 22:11:06 +02:00

url-guard.test.ts

fix: block loopback, CGNAT and IPv6 transition ranges in the SSRF guard

2026-09-26 14:00:01 +02:00

validation.test.ts

fix: show what a mailto unsubscribe sends and limit it to one recipient

2026-09-26 14:41:14 +02:00

vcard.test.ts

fix: set name.full on all contact write paths so vCards carry mandatory FN #430

2026-08-31 23:53:24 +02:00

verification-code.test.ts

fix: stop offering ISO timestamps as verification codes #1236

2026-10-14 00:15:08 +02:00

verification-failure.test.ts

fix: explain why calendar subscriptions fail with not authenticated #1073

2026-09-23 18:31:27 +02:00

verify-jmap-auth.test.ts

fix: pin resolved IP at connect time to block DNS-rebinding SSRF (GHSA-24w9-8r42-8jwm)

2026-08-26 22:11:06 +02:00

verify-jmap-identity.test.ts

fix: key synced settings on the account a bearer token belongs to

2026-09-26 14:59:55 +02:00

version-check-upgrade.test.ts

fix: invalidate persisted update status after an upgrade

2026-08-29 12:46:39 +02:00

version-compare.test.ts

fix: warn + block install when app version is below plugin's minAppVersion

2026-05-16 18:11:52 +02:00

web-push.test.ts

Merge pull request #1054 from lucamzanon/feat/multi-account-push

2026-10-10 19:24:10 +02:00

webdav-route.test.ts

fix: pin supported-calendar-component-set on created calendars #760

2026-08-25 19:16:20 +02:00

wopi-attachment-routes.test.ts

fix: open read-only documents in ONLYOFFICE without the -103 warning #1187

2026-10-08 14:32:39 +02:00

wopi-reverse-proxy.test.ts

fix: open the WOPI editor behind a reverse proxy with split addresses #1130

2026-10-04 22:16:29 +02:00

wopi-shared-file-routes.test.ts

fix: open read-only documents in ONLYOFFICE without the -103 warning #1187

2026-10-08 14:32:39 +02:00

wopi-token-not-a-session.test.ts

feat: open office attachments in mail read-only in the document editor #1047

2026-09-23 19:01:47 +02:00

wopi.test.ts

fix: open read-only documents in ONLYOFFICE without the -103 warning #1187

2026-10-08 14:32:39 +02:00