Send account requests to the account's own Stalwart #333

New Issue

Closed

opened 2026-09-13 21:45:30 +00:00 by jcoffey-dev · 0 comments

jcoffey-dev commented

2026-09-13 21:45:30 +00:00

Owner

Summary

With a domain mapped to its own Stalwart (#238), two requests still went to STALWART_URL:

/api/account/* (password, app passwords, 2FA) re-fetched the upstream session without upstreamFor(). Once the five-minute session cache expired, a mapped account's credential calls reached the default server, which either rejects the password or has a different account with the same name.
The locale lookup resolved Stalwart's apiUrl against the default server instead of session.baseUrl.

Both now go to the server that issued the session. Found while scoping in-app administration, which would have inherited the same routing.

Testing

New test in accountinfo.test.ts: every account-info request goes to the session's server. It fails without the upstream.ts change and passes with it.
npm run typecheck -w server and npm test -w server: 169/169 pass.

Translations

No user-visible strings added or changed.

Merged 2026-09-13 as coffey-labs/ihasmail@5f5672fed3

_{Rebuilt from: git history, session transcript.}

## Summary With a domain mapped to its own Stalwart (#238), two requests still went to `STALWART_URL`: - **`/api/account/*`** (password, app passwords, 2FA) re-fetched the upstream session without `upstreamFor()`. Once the five-minute session cache expired, a mapped account's credential calls reached the default server, which either rejects the password or has a different account with the same name. - **The locale lookup** resolved Stalwart's `apiUrl` against the default server instead of `session.baseUrl`. Both now go to the server that issued the session. Found while scoping in-app administration, which would have inherited the same routing. ## Testing - New test in `accountinfo.test.ts`: every account-info request goes to the session's server. It fails without the `upstream.ts` change and passes with it. - `npm run typecheck -w server` and `npm test -w server`: 169/169 pass. ## Translations No user-visible strings added or changed. **Merged** 2026-09-13 as coffey-labs/ihasmail@5f5672fed378 <sub>Rebuilt from: git history, session transcript.</sub>

This repo is archived. You cannot comment on issues.

1 Participants

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: coffey-labs/ihasmail-github-archive#333