Merge pull request #350 from ChrispyBacon-dev/unstable

v3.1.1 - details changelog

Author: ChrispyBacon-dev

CHANGELOG.md

@@ -3,6 +3,41 @@
 All notable changes to this project will be documented in this file.
 
 
+## [v3.1.1] - 2026-04-24
+
+### Added
+- **Webmail - Inline Settings:** Settings replaced the modal with a split-panel layout inside the main mail area. Clicking any folder exits settings. Mobile uses a full-screen overlay with a back button.
+- **Webmail - Appearance Setting:** Date and time format selector (US, European, ISO 8601) persisted to localStorage, applied to all timestamps.
+- **Webmail - About and Help Sections:** About shows project links ([dockflare.app](https://dockflare.app), GitHub) and a PWA install prompt. Help is a placeholder for future documentation with a GitHub and issue tracker link.
+- **Webmail - Bulk Email Actions:** Multi-select mode in the message list with select-all, trash, and folder move controls.
+- **Webmail - Animated Logo:** Sidebar shows the animated DockFlare logo when expanded, falls back to `DF` when collapsed.
+- **Email Alias System:** A disposable email alias layer for the DockFlare Email Suite.
+  - **Alias Creation:** Generate aliases with three styles (`word-word-num`, `word-num`, `uuid-short`) or define a custom local-part.
+  - **Inbound Forwarding:** Aliases enforced at the Cloudflare Worker layer via KV lookups. Unknown aliases are rejected at the SMTP level.
+  - **Outbound Reply Support:** Replying to an alias-received email pre-selects the alias as sender via a From dropdown.
+  - **Alias Management UI:** Create, toggle, set expiry, label, describe, and delete aliases from Settings. Usage count tracked per alias.
+  - **Alias Expiry:** Hourly background job deactivates expired aliases and removes their KV entries from Cloudflare.
+  - **Per-Alias Rate Limiting:** 20 alias creations per hour and 100 per mailbox enforced server-side.
+- **Webmail Compose Enhancements:**
+  - **Multi-Recipient To Field:** Multiple recipients as chips, confirmed with Enter, Tab, or comma. Supports paste of comma-separated lists.
+  - **Cc and Bcc Fields:** Hidden by default, revealed via inline buttons.
+  - **Sent Folder Recipient Display:** Sent messages show recipient addresses instead of the sender.
+  - **Emoji Picker:** Searchable, categorized, lazy-loaded emoji selector in the compose toolbar.
+  - **Inline Link Popover:** Link insertion opens an inline popover instead of a browser prompt.
+- **Mobile Support:** Fully responsive webmail for phones and small screens.
+  - **Single-Panel Navigation:** Stacked Folders, Message List, and Message Detail panels with a back button.
+  - **Bottom Navigation Bar:** Persistent bar with Folders, Compose, and Mail shortcuts.
+  - **Full-Screen Compose:** Compose opens as a full-screen overlay on mobile.
+  - **iOS Safe Area Support:** Bottom navigation respects the iOS home indicator via `viewport-fit=cover`.
+
+### Changed
+- **Webmail - Sidebar Layout:** Collapse and expand controls moved to the bottom action bar. Sidebar header reserved for the logo.
+- **Webmail - Folder Navigation:** Removed the "CUSTOM" section label. Active custom folders use a `FolderOpen` icon.
+- **Webmail - Alias Delete:** Native browser confirm dialog replaced with a styled in-app confirmation modal.
+
+### Fixed
+- **Webmail - Dark Mode:** Placeholder text in the reply composer and input backgrounds in the settings panel were broken in dark mode due to a Vue scoped CSS compilation issue. Fixed throughout.
+
 ## [v3.1.0] - 2026-04-16
 
 > **Cloudflare Context:** Cloudflare's Email Service entered public beta today — the same `send_email` Workers binding that powers DockFlare Mail's outbound relay is now generally available. Read the announcement: [Email for Agents](https://blog.cloudflare.com/email-for-agents/)

dockflare/app/config.py

@@ -35,7 +35,7 @@ def _get_int_env(name, default, minimum=None):
         return default
 
 # --- DockFlare Version ---
-APP_VERSION = "v3.1.0"
+APP_VERSION = "v3.1.1"
 # --- web: https://dockflare.app ---
 # --- github: https://github.com/ChrispyBacon-dev/DockFlare ---
 

dockflare/app/core/email_manager.py

@@ -337,6 +337,28 @@ def create_kv_namespace(title):
                          json_data={'title': title})
     return res.get('result', {}).get('id')
 
+
+def get_or_create_kv_namespace(title):
+    try:
+        ns_id = create_kv_namespace(title)
+        if ns_id:
+            return ns_id
+    except Exception:
+        pass
+    page = 1
+    while True:
+        res = cf_api_request('GET', f'/accounts/{config.CF_ACCOUNT_ID}/storage/kv/namespaces',
+                             params={'per_page': 100, 'page': page})
+        results = res.get('result') or []
+        for ns in results:
+            if ns.get('title') == title:
+                return ns.get('id')
+        info = res.get('result_info', {})
+        if page >= info.get('total_pages', 1):
+            break
+        page += 1
+    return None
+
 def update_kv_entry(namespace_id, key, value_dict):
     url = f"{config.CF_API_BASE_URL}/accounts/{config.CF_ACCOUNT_ID}/storage/kv/namespaces/{namespace_id}/values/{key}"
     headers = {"Authorization": f"Bearer {config.CF_API_TOKEN}", "Content-Type": "text/plain"}

dockflare/app/core/worker_templates/inbound_worker.js

@@ -30,10 +30,11 @@ async function dispatchWebhook(env, payload) {
 }
 
 export default {
-  // ── Inbound email handler ──────────────────────────────────────────────────-.--...--
   async email(message, env, ctx) {
     try {
+      let resolvedMailbox = null;
       const catchAllEnabled = env.CATCH_ALL_ENABLED === 'true';
+
       if (catchAllEnabled) {
         const domain = (env.DOMAIN_NAME || '').toLowerCase();
         if (!message.to.toLowerCase().endsWith('@' + domain)) {
@@ -43,21 +44,28 @@ export default {
       } else {
         const allowedRecipients = JSON.parse(env.ALLOWED_RECIPIENTS || '[]');
         if (!allowedRecipients.includes(message.to)) {
-          message.setReject("Recipient not allowed");
-          return;
+          let aliasRecord = null;
+          try {
+            aliasRecord = await env.QUOTA_KV.get('alias::' + message.to, 'json');
+          } catch (_) {}
+
+          if (!aliasRecord) {
+            message.setReject("Recipient not allowed");
+            return;
+          }
+          resolvedMailbox = aliasRecord.mailbox;
         }
       }
 
-      // Check quota KV before accepting — reject at SMTP level so sender gets a bounce
       if (typeof env.QUOTA_KV !== 'undefined') {
         try {
-          const state = await env.QUOTA_KV.get(message.to, "json");
+          const quotaTarget = resolvedMailbox || message.to;
+          const state = await env.QUOTA_KV.get(quotaTarget, "json");
           if (state?.blocked) {
             message.setReject("550 5.2.2 Mailbox full");
             return;
           }
         } catch (kvErr) {
-          // KV unavailable — fall through, webhook safety net handles enforcement
           console.warn(`KV quota check failed for ${message.to}: ${kvErr.message}`);
         }
       }
@@ -66,12 +74,13 @@ export default {
       const r2Key = `temp_cache/${messageId}.eml`;
       const receivedAt = new Date().toISOString();
 
-      // Upload to R2 first — email is now safely buffered regardless of what happens next
       const rawBytes = await new Response(message.raw).arrayBuffer();
       await env.EMAIL_BUCKET.put(r2Key, rawBytes, {
         customMetadata: {
           from: message.from,
           to: message.to,
+          resolved_mailbox: resolvedMailbox || message.to,
+          via_alias: resolvedMailbox ? "1" : "0",
           subject: message.headers.get("subject") || "",
           receivedAt: receivedAt
         }
@@ -81,6 +90,8 @@ export default {
         message_id: messageId,
         from: message.from,
         to: message.to,
+        resolved_mailbox: resolvedMailbox || message.to,
+        via_alias: !!resolvedMailbox,
         subject: message.headers.get("subject") || "",
         received_at: receivedAt,
         r2_key: r2Key,
@@ -92,31 +103,21 @@ export default {
         if (webhookResponse.ok) {
           const body = await webhookResponse.json().catch(() => ({}));
           if (body.reason === 'over_hard_quota') {
-            // Mail Manager rejected the email (hard quota exceeded) and already cleaned
-            // up R2 + the DB entry. Reject at SMTP level so sender gets an NDR bounce.
             message.setReject("550 5.2.2 Mailbox full");
             return;
           }
-          // On success the mail-manager deletes the R2 file itself after processing.
         } else {
-          // DockFlare returned an error — leave email in R2 for cron retry.
-          // The email is safely buffered and will be delivered
-          // automatically when DockFlare is healthy again.
           console.warn(`Webhook returned ${webhookResponse.status} for ${messageId} — buffered in R2 for retry`);
         }
       } catch (webhookErr) {
-        // DockFlare is unreachable (offline, timeout, network error).
-        // Email is already in R2. Cron will retry. Do NOT reject.
         console.warn(`Webhook unreachable for ${messageId} — buffered in R2 for retry: ${webhookErr.message}`);
       }
 
     } catch (err) {
-      // Only reject if failed to store the email in R2 (truly unrecoverable). - reminder need some tests still 
       message.setReject(`Worker error: ${err.message}`);
     }
   },
 
-  // ── Cron trigger: retry buffered emails in R2 ─────────────────────────-..-.-.-.-────
   async scheduled(event, env, ctx) {
     console.log("Cron: scanning R2 temp_cache for buffered emails...");
 
@@ -140,6 +141,8 @@ export default {
           message_id: messageId,
           from: meta.from || "",
           to: meta.to || "",
+          resolved_mailbox: meta.resolved_mailbox || meta.to || "",
+          via_alias: meta.via_alias === "1",
           subject: meta.subject || "",
           received_at: meta.receivedAt || new Date().toISOString(),
           r2_key: r2Key,
@@ -151,8 +154,6 @@ export default {
           if (response.ok) {
             const body = await response.json().catch(() => ({}));
             if (body.reason === 'over_hard_quota') {
-              // Mailbox was full when cron retried — webhook already cleaned R2 + set KV block.
-              // Count as processed (not a retry-able failure).
               console.warn(`Cron: buffered email ${messageId} rejected (over_hard_quota) — R2 cleaned by Mail Manager`);
               processed++;
             } else {
@@ -165,7 +166,6 @@ export default {
             failed++;
           }
         } catch (err) {
-          // DockFlare still offline — will retry on next cron run
           console.warn(`Cron: DockFlare still unreachable for ${messageId}: ${err.message}`);
           failed++;
         }

dockflare/app/core/worker_templates/outbound_worker.js

@@ -10,10 +10,8 @@ export default {
       return new Response("Unauthorized", { status: 401 });
     }
     const body = await request.json();
-    const toHeader = Array.isArray(body.to) ? body.to.join(", ") : body.to;
-    const rawTo = Array.isArray(body.to) ? body.to[0] : body.to;
-    const addrMatch = typeof rawTo === 'string' ? rawTo.match(/<([^>]+)>/) : null;
-    const toAddress = addrMatch ? addrMatch[1] : (typeof rawTo === 'string' ? rawTo.trim() : rawTo);
+    const toList = Array.isArray(body.to) ? body.to : [body.to];
+    const toHeader = toList.join(", ");
 
     const attachments = Array.isArray(body.attachments) ? body.attachments.filter(a => a && a.data_b64) : [];
     const hasAttachments = attachments.length > 0;
@@ -73,9 +71,13 @@ export default {
       mimeMessage += `--${innerBoundary}--\r\n`;
     }
 
-    const message = new EmailMessage(body.from, toAddress, mimeMessage);
     try {
-      await env.SEND_EMAIL.send(message);
+      for (const recipient of toList) {
+        const addrMatch = typeof recipient === 'string' ? recipient.match(/<([^>]+)>/) : null;
+        const toAddress = addrMatch ? addrMatch[1] : (typeof recipient === 'string' ? recipient.trim() : recipient);
+        const message = new EmailMessage(body.from, toAddress, mimeMessage);
+        await env.SEND_EMAIL.send(message);
+      }
       return new Response(JSON.stringify({ success: true, message_id: body.messageId }), {
         status: 200,
         headers: { "Content-Type": "application/json" }

dockflare/app/web/email_routes.py

@@ -399,15 +399,15 @@ def _redeploy_inbound_worker(email_cfg, domain):
 
     kv_ns_id = d.get('quota_kv_namespace_id')
     if not kv_ns_id:
-        try:
-            kv_ns_id = email_manager.create_kv_namespace(
-                f"dockflare-quota-{domain.replace('.', '-')}"
-            )
+        kv_ns_id = email_manager.get_or_create_kv_namespace(
+            f"dockflare-quota-{domain.replace('.', '-')}"
+        )
+        if kv_ns_id:
             email_cfg['domains'][domain]['quota_kv_namespace_id'] = kv_ns_id
             save_email_config(email_cfg)
-            logging.info(f"Created quota KV namespace for existing domain {domain}: {kv_ns_id}")
-        except Exception as e:
-            logging.warning(f"Could not create quota KV namespace for {domain}: {e}")
+            logging.info(f"Resolved quota KV namespace for {domain}: {kv_ns_id}")
+        else:
+            logging.warning(f"Could not resolve quota KV namespace for {domain}")
 
     catch_all_address = d.get('catch_all_address', '')
     catch_all_enabled = 'true' if catch_all_address else 'false'
@@ -1190,6 +1190,78 @@ def quota_kv_sync():
     return jsonify({'status': 'ok', 'action': action})
 
 
+@email_bp.route('/internal/alias-kv-sync', methods=['POST'])
+def alias_kv_sync():
+    if not _check_internal_request():
+        return jsonify({'error': 'forbidden'}), 403
+    data = request.get_json(force=True, silent=True) or {}
+    domain = data.get('domain')
+    alias_address = data.get('alias_address')
+    action = data.get('action')
+    mailbox_address = data.get('mailbox_address')
+    if not domain or not alias_address or action not in ('put', 'delete'):
+        return jsonify({'error': 'missing domain, alias_address, or valid action'}), 400
+    if action == 'put' and not mailbox_address:
+        return jsonify({'error': 'mailbox_address required for put'}), 400
+    cfg = config.EMAIL_CONFIG
+    if not cfg or domain not in cfg.get('domains', {}):
+        return jsonify({'status': 'domain_not_found'}), 200
+    kv_ns_id = cfg['domains'][domain].get('quota_kv_namespace_id')
+    if not kv_ns_id:
+        return jsonify({'status': 'no_kv'}), 200
+    kv_key = f"alias::{alias_address}"
+    try:
+        if action == 'put':
+            email_manager.update_kv_entry(kv_ns_id, kv_key, {"mailbox": mailbox_address})
+        else:
+            email_manager.delete_kv_entry(kv_ns_id, kv_key)
+    except Exception as e:
+        logging.warning(f"alias-kv-sync {action} failed for {alias_address}: {e}")
+        return jsonify({'error': str(e)}), 500
+    return jsonify({'status': 'ok', 'action': action})
+
+
+@email_bp.route('/domain/<domain>/aliases', methods=['GET'])
+@login_required
+def domain_aliases(domain):
+    import requests as req_lib
+    token = _generate_jwt(current_user.get_id(), role='admin')
+    if not token:
+        return jsonify({'error': 'JWT configuration missing'}), 500
+    try:
+        resp = req_lib.get(
+            f"{config.MAIL_MANAGER_INTERNAL_URL}/api/v1/system/aliases",
+            headers={'Authorization': f'Bearer {token}'},
+            params={'domain': domain},
+            timeout=10,
+        )
+        if resp.ok:
+            return jsonify(resp.json())
+        return jsonify({'error': 'mail-manager unreachable'}), 502
+    except Exception as e:
+        return jsonify({'error': str(e)}), 500
+
+
+@email_bp.route('/alias/<path:address>/delete', methods=['POST'])
+@login_required
+def admin_delete_alias(address):
+    import requests as req_lib
+    token = _generate_jwt(current_user.get_id(), role='admin')
+    if not token:
+        return jsonify({'error': 'JWT configuration missing'}), 500
+    try:
+        resp = req_lib.delete(
+            f"{config.MAIL_MANAGER_INTERNAL_URL}/api/v1/aliases/{address}",
+            headers={'Authorization': f'Bearer {token}'},
+            timeout=10,
+        )
+        if resp.ok:
+            return jsonify({'status': 'deleted'})
+        return jsonify({'error': resp.text[:200]}), resp.status_code
+    except Exception as e:
+        return jsonify({'error': str(e)}), 500
+
+
 def _restart_mail_container():
     try:
         container = docker_client.containers.get('dockflare-mail-manager')

dockflare/app/web/routes.py

@@ -188,7 +188,7 @@ def gating_logic():
             return
 
         if not current_user.is_authenticated:
-            exempt_endpoints = ['static', 'web.ping', 'web.cloudflare_ping_route', 'setup.step_import_env', 'email.internal_mail_config', 'email.mailbox_login', 'email.quota_kv_sync']
+            exempt_endpoints = ['static', 'web.ping', 'web.cloudflare_ping_route', 'setup.step_import_env', 'email.internal_mail_config', 'email.mailbox_login', 'email.quota_kv_sync', 'email.alias_kv_sync']
             oauth_endpoints = ['web.login_provider', 'web.auth_callback', 'web.login']
             if request.endpoint and not request.endpoint.startswith('auth.') and request.endpoint not in exempt_endpoints and request.endpoint not in oauth_endpoints:
                 try: