Enhance mail filtering and JSON serialization

- Added `IsAdmin` parameter and mail group access filtering in `GetMails` to enforce access control for non-admin users.
- Updated SQL queries in `GetMails` to include `MailGroup` table for filtering and consistency.
- Added `JsonStringEnumConverter` in `Program.cs` to serialize enums as strings for improved API usability.
- Explicitly cast `role` to `Role` enum in `user-management.component.ts` to ensure type safety.

Author: Timothy Dodd

src/MailVoidApi/Controllers/MailController.cs

@@ -120,25 +120,37 @@ public async Task<PagedResults<MailWithReadStatus>> GetMails([FromBody(EmptyBody
         var whereClauses = new List<string>();
         var parameters = new DynamicParameters();
         parameters.Add("UserId", currentUserId);
+        parameters.Add("IsAdmin", isAdmin);
 
         if (!string.IsNullOrEmpty(options.To))
         {
             whereClauses.Add("m.`To` = @To");
             parameters.Add("To", options.To);
         }
 
+        // Filter by mail group access - user must have access to the mail group
+        // Admins can see all, others can only see emails in groups they have access to
+        if (!isAdmin)
+        {
+            whereClauses.Add(@"(
+                mg.IsPublic = 1
+                OR mg.OwnerUserId = @UserId
+                OR EXISTS (SELECT 1 FROM MailGroupUser mgu WHERE mgu.MailGroupId = mg.Id AND mgu.UserId = @UserId)
+            )");
+        }
+
         var whereClause = whereClauses.Count > 0 ? "WHERE " + string.Join(" AND ", whereClauses) : "";
 
         if (options.PageSize == 1)
         {
             results.TotalCount = await db.ExecuteScalarAsync<int>(
-                $"SELECT COUNT(*) FROM Mail m {whereClause}", parameters);
+                $"SELECT COUNT(*) FROM Mail m LEFT JOIN MailGroup mg ON m.MailGroupPath = mg.Path {whereClause}", parameters);
         }
 
         var offset = (options.Page - 1) * options.PageSize;
         var mails = await db.QueryAsync<Mail>(
-            $"SELECT * FROM Mail m {whereClause} ORDER BY CreatedOn DESC LIMIT @Limit OFFSET @Offset",
-            new { Limit = options.PageSize, Offset = offset, To = options.To, UserId = currentUserId });
+            $"SELECT m.* FROM Mail m LEFT JOIN MailGroup mg ON m.MailGroupPath = mg.Path {whereClause} ORDER BY m.CreatedOn DESC LIMIT @Limit OFFSET @Offset",
+            new { Limit = options.PageSize, Offset = offset, To = options.To, UserId = currentUserId, IsAdmin = isAdmin });
 
         var mailList = mails.ToList();
         var mailIds = mailList.Select(m => m.Id).ToList();

src/MailVoidApi/Program.cs

@@ -1,6 +1,7 @@
 using System.IdentityModel.Tokens.Jwt;
 using System.IO.Compression;
 using System.Text;
+using System.Text.Json.Serialization;
 using MailVoidApi.Authentication;
 using MailVoidApi.Data;
 using MailVoidApi.Hubs;
@@ -40,7 +41,11 @@ public static async Task Main(string[] args)
         builder.Services.AddHostedService<BackgroundWorkerService>();
         builder.Services.AddHostedService<MailCleanupService>();
         builder.Services.AddHostedService<WebhookCleanupService>();
-        builder.Services.AddControllers();
+        builder.Services.AddControllers()
+            .AddJsonOptions(options =>
+            {
+                options.JsonSerializerOptions.Converters.Add(new JsonStringEnumConverter());
+            });
         builder.Services.AddSignalR();
         builder.Services.AddMemoryCache();
         // Register HttpContextAccessor

src/MailVoidWeb/src/app/_components/user-management/user-management.component.ts

@@ -183,7 +183,7 @@ export class UserManagementComponent {
     const request: CreateUserRequest = {
       userName: formValue.username,
       password: formValue.password,
-      role: formValue.role,
+      role: Number(formValue.role) as Role,
     };
 
     try {