4 Commits

Include renames

Author	SHA1	Message	Date
jcoffey-dev	1acf2f29e7	Confirm a typed password without replaying it over JMAP ... Creating an app password asks for the account password. A session holding a token has no password to compare with, so it sent the typed one to the mail server as HTTP Basic on the JMAP session. INBUXA's server now takes no password outside DAV (contract C-23), so that check would always fail. It now asks the server's sign-in endpoint, the one its own sign-in page posts to, as this client, to its registered redirect URI, with a PKCE challenge whose verifier is thrown away so the code can never be exchanged. "Two-factor code needed" counts as confirmed: the server says so only after the password matched, so accounts with two-factor sign-in now pass where the Basic check failed them. The mock answers /api/auth like the server and can refuse Basic on JMAP; the app-password test turns that on, and fails on the old check.	2026-09-29 06:50:32 -07:00
jcoffey-dev	bb25355c23	AGPL source offer and name cleanup ... Every build writes the exact source it was built from, uncommitted work and new files included, as source.tar.gz next to the app, named after that tree. Docker builds, which have no git, pack the build context and name it by a hash of its files. The sign-in page and Settings > About link to it instead of a repository that can drift. What users, operators and packagers see no longer names the upstream server: - interface text, in all nine catalogues, with a token-session line for Security; - server messages; - the settings, now MAIL_SERVER_URL, MAIL_SERVERS_FILE, ADMIN_URL and MAIL_SERVER_FOLLOW_ADVERTISED_URLS, and mail-servers.example.json; - the Tenants notice, which is gone; - the README, CONTRIBUTING and SECURITY. ihasmail's own FEATURES, KNOWN-ISSUES and ROADMAP stay with public ihasmail, and INBUXA.md is folded into the README.	2026-09-19 00:13:12 -07:00
jcoffey-dev	cdd8fabff9	No address step before signing in when there's only one mail server ... The server's own page asks for the username, so with a single server the sign-in page keeps only the own-device choice. With several servers the address still comes first, since its domain picks the server. One new string, in all nine catalogues.	2026-09-18 15:51:54 -07:00
jcoffey-dev	8857bdac30	Sign in on the mail server's own page (OAuth with PKCE), sessions hold tokens; tenants on every edition ... Contract C-8 and C-10: with OAUTH_CLIENT_SECRET set, sign-in goes through the server's page and the session keeps sealed tokens, renewed before they expire, instead of a password. Push keeps a credential that renews itself. A password change signs the session out, since the server revokes its tokens. The mock answers OAuth for tests and development. Eleven new strings, in all nine catalogues.	2026-09-18 15:30:37 -07:00