Retention on one page, as sentences

jcoffey-dev commented

2026-09-28 19:58:32 +00:00

Owner

Second second-wave item from the settings-reorg spec. Based on main; independent of the other open PRs.

The "how long is this kept" settings were spread over four x:DataRetention pages of config-named fields ("Trash/Junk", "Email Submissions", "MTA Reports"…), plus log files on Hardening. Each retention page now opens with all of them as sentences:

In people's mailboxes:
- empty Trash and Junk after …
- clear handled calendar invitations after …
- forget "shared with you" notices after …
- forget the sending status of sent mail after … ("the sent message itself stays")
Getting deleted things back: let people get deleted mail, contacts and events back for …; keep a deleted account restorable for … Unset means off: deleting is final.
The server's own records: delivery history, charts' history, DMARC and TLS reports from other servers, and old log files (inbuxa:LogSettings, the same setting as on Hardening).

Each sentence has:

a number and unit (days or hours; days only for logs), or its own never / off / forever, with a toggle to switch;
its default underneath;
an unsaved mark until Save N changes.

Only changed values are sent. A note says that mail under a legal hold is kept whatever these say (audit-hold-lock spec LH: deleted held mail is archived, and doesn't expire while held).

The page's own settings (the expunge and cleanup schedules, change history, metrics interval) stay in its form, folded under Schedules and every setting on this page, which reloads after a save so the two never disagree. maxChangesHistory isn't a duration and stays there.

Checked: unit tests for the duration parts and item coverage (all 9 durations once, plus logs; 427 total), plus typecheck, lint and build. In Chrome against a local server, Trash was set to 14 days, deleted-item recovery switched on (30 days) and log files set to 60 days in one save. Read back over JMAP they were 1209600000 ms, 2592000000 ms and keepForDays: 60.

English only: about 30 new strings.

Second second-wave item from the settings-reorg spec. Based on main; independent of the other open PRs. The "how long is this kept" settings were spread over four x:DataRetention pages of config-named fields ("Trash/Junk", "Email Submissions", "MTA Reports"…), plus log files on Hardening. Each retention page now opens with all of them as sentences: - **In people's mailboxes:** - empty Trash and Junk after … - clear handled calendar invitations after … - forget "shared with you" notices after … - forget the sending status of sent mail after … ("the sent message itself stays") - **Getting deleted things back:** let people get deleted mail, contacts and events back for …; keep a deleted account restorable for … Unset means *off: deleting is final*. - **The server's own records:** delivery history, charts' history, DMARC and TLS reports from other servers, and old log files (inbuxa:LogSettings, the same setting as on Hardening). Each sentence has: - a number and unit (days or hours; days only for logs), or its own *never* / *off* / *forever*, with a toggle to switch; - its default underneath; - an *unsaved* mark until **Save N changes**. Only changed values are sent. A note says that mail under a legal hold is kept whatever these say (audit-hold-lock spec LH: deleted held mail is archived, and doesn't expire while held). The page's own settings (the expunge and cleanup schedules, change history, metrics interval) stay in its form, folded under *Schedules and every setting on this page*, which reloads after a save so the two never disagree. `maxChangesHistory` isn't a duration and stays there. **Checked:** unit tests for the duration parts and item coverage (all 9 durations once, plus logs; 427 total), plus typecheck, lint and build. In Chrome against a local server, Trash was set to 14 days, deleted-item recovery switched on (30 days) and log files set to 60 days in one save. Read back over JMAP they were 1209600000 ms, 2592000000 ms and `keepForDays: 60`. English only: about 30 new strings.

jcoffey-dev added 4 commits 2026-09-28 21:57:13 +00:00

Guided setup: connect a sign-in directory

ci / build (pull_request) Successful in 2m4s

Details

ci / publish (pull_request) Skipped

Details

0c64ff214b

Directories and Authentication offer a guide ("Guided or manual?" each
time) that:

- starts from Active Directory, OpenLDAP, FreeIPA, Keycloak, Authentik
  or another OpenID Connect provider, with filters and attributes set for
  that directory and example connection values;
- saves the directory, which changes nothing while no domain uses it,
  and tests a real person against it with the server's directory test:
  found or not (with aliases and groups), and whether a password signs
  in, a wrong password told apart from a broken connection. The guide
  won't go on until a person is found and, if given, the password works;
- then asks which domains sign in through it, with each domain's account
  count, and the server default as a separate switch. Choosing the
  domain you sign in on, or the default, needs an explicit "I've checked
  I can still sign in";
- switches the chosen domains over, putting them back if making it the
  default is refused.

Needs inbuxa-server's POST /api/directory/test.

Sender checks as a level: Relaxed, Recommended or Strict

ci / build (pull_request) Successful in 1m38s

Details

ci / publish (pull_request) Skipped

Details

86ae2c6672

Mail flow › Receiving › Sender checks opens with one choice instead of
six strategy fields, and a table of what each level does to mail that
fails. From the SMTP code:

- Relaxed (the stock settings): SPF, DKIM, DMARC and reverse DNS are
  checked on port 25 and scored by the spam filter; nothing is refused.
- Recommended: also refuses mail that fails DMARC for a domain that
  publishes p=reject, and checks ARC.
- Strict: also refuses senders that fail reverse DNS or SPF on MAIL
  FROM (including senders with none), and broken ARC chains. It warns
  that some real mail from small or badly set-up servers will bounce.

No level refuses unsigned mail (strict DKIM, which RFC 6376 advises
against). Checks stay on port 25, like the stock settings. Values set by
hand show as "Set by hand below", and applying a level then says it
replaces them. The form reloads after a level is applied; DKIM signing
isn't touched.

Limits as sentences, with presets for who uses the server

ci / build (pull_request) Successful in 2m4s

Details

ci / publish (pull_request) Skipped

Details

8fdae4a32b

A stock server has no rate limits: one stolen password can send without
end. A guide ("Guided or manual?" each time) asks who uses the server
(me and my family, a company or school, open to the public) and offers
five rules as sentences with numbers you can change:

- each outside server may connect N times a minute on port 25;
- each signed-in person may send N messages an hour;
- each signed-in person may address N recipients an hour in total
  (keyed by account alone; the condition reads rcpt, so the server
  checks it at RCPT TO);
- at most N deliveries a minute to any one receiving server;
- each sender may have at most N messages waiting.

Rules it writes are marked "Preset:" so running it again edits them; it
never touches rules made by hand. Above the incoming, outgoing and quota
lists, every rule now reads as a sentence, and an empty list says that
nothing is limited.

Retention on one page, as sentences

ci / build (pull_request) Successful in 2m2s

Details

ci / publish (pull_request) Skipped

Details

7b65b8eb34

Every "how long is this kept" setting was spread over four pages of
fields named after the config, plus log files on the Hardening page.
Each retention page now opens with all of them as sentences:

- in people's mailboxes: empty Trash and Junk after, clear handled
  calendar invitations after, forget share notices after, forget the
  sending status of sent mail after;
- getting deleted things back: deleted items and deleted accounts;
- the server's own records: delivery history, charts' history, DMARC
  and TLS reports from other servers, and old log files.

Each has a number and unit (or its own never / off / forever), its
default beneath, and an unsaved mark until the changes are saved
together. It says that mail under a legal hold is kept whatever these
say. The page's own settings (schedules and the like) are folded
underneath and reload after a save.

jcoffey-dev force-pushed feature/retention-page from 83772878f2 to 7b65b8eb34

2026-09-28 21:57:13 +00:00

Compare

jcoffey-dev merged commit fdfb6fbfea into main

2026-09-28 22:00:49 +00:00

jcoffey-dev deleted branch feature/retention-page

2026-09-28 22:00:49 +00:00

Retention on one page, as sentences #43