inbuxa/ihasmail-inbuxa
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Sign in on the mail server's own page (OAuth with PKCE), sessions hold tokens; tenants on every edition

Browse Source 
Contract C-8 and C-10: with OAUTH_CLIENT_SECRET set, sign-in goes through the
server's page and the session keeps sealed tokens, renewed before they expire,
instead of a password. Push keeps a credential that renews itself. A password
change signs the session out, since the server revokes its tokens. The mock
answers OAuth for tests and development. Eleven new strings, in all nine
catalogues.
This commit is contained in:
jcoffey-dev
2026-09-18 15:30:37 -07:00
parent c118184975
commit 8857bdac30
24 changed files with 1058 additions and 74 deletions
Download Patch File Download Diff File Expand all files Collapse all files
INBUXA.md
+40
View File
@@ -0,0 +1,40 @@
# ihasmail-inbuxa
This is ihasmail for INBUXA's mail server. Public ihasmail stays
Stalwart-facing; everything specific to INBUXA lives here until one product
can serve both. The contract between the two is `docs/spec/contract.md` in
the inbuxa-server repository.
Public ihasmail is the remote `ihasmail`, fetch-only. Merge its `main` in to
keep up. Nothing here is pushed there.
## What's different
- **Sign-in happens on the mail server's own page** (contract C-8, C-10).
ihasmail sends the browser there and gets OAuth tokens back, so it never
handles a password to sign someone in. Two-factor codes are asked for on
that page. Sessions hold sealed tokens and renew them before they expire. A
password change revokes the tokens, so it signs the person out everywhere,
this session included.
- **Tenants are offered on every server**, whatever edition it reports.
`SHOW_ENTERPRISE_NOTICES` still adds the notice for an upstream Stalwart.
## Configuration
Server sign-in is on when `OAUTH_CLIENT_SECRET` is set. Without it,
ihasmail-inbuxa keeps public ihasmail's password form.
| Variable | Meaning |
|---|---|
| `OAUTH_CLIENT_SECRET` | The secret of the confidential client the mail server registers for this webmail. On INBUXA, the same value as the server's `INBUXA_WEBMAIL_CLIENT_SECRET`. |
| `OAUTH_CLIENT_ID` | The client's id. Default `ihasmail-inbuxa`, which is what INBUXA registers. |
| `PUBLIC_URL` | Where browsers reach ihasmail, without `BASE_PATH`. Required with `OAUTH_CLIENT_SECRET`. The redirect URI is `PUBLIC_URL` + `BASE_PATH` + `/api/auth/callback`, and must match the server's `INBUXA_WEBMAIL_URL` + `/api/auth/callback` exactly. |
On the INBUXA server, set `INBUXA_WEBMAIL_URL` to ihasmail's address (with
`BASE_PATH`, if any) and `INBUXA_WEBMAIL_CLIENT_SECRET` to the shared secret.
The server registers the client on start and allows ihasmail's origin for
cross-origin requests.
For local development, `npm run dev:mock` works as before. The mock also
answers OAuth: start it and ihasmail with `OAUTH_CLIENT_SECRET=mock-oauth-secret`
and a `PUBLIC_URL`, and its sign-in page approves the demo user at once.