mfa fixing

internal/webui/webmail_account.go

@@ -15,7 +15,10 @@ import (
 // usage, password change, TOTP MFA enable/disable, registered passkeys, and app
 // passwords for IMAP/SMTP clients — everything scoped to reusing the app-password
 // CRUD already built for the admin-managed mailbox pages (db.ListAppPasswordsForMailbox
-// etc.), just presented for self-service instead of admin management.
+// etc.), just presented for self-service instead of admin management. Only ever
+// reached with MFA already satisfying enforce_mailbox_mfa (or enforcement off) —
+// requireMailboxAuth redirects everywhere else, including here, to the isolated
+// /mfa-setup page otherwise (see webmailMFASetupRequiredPage).
 func (a *App) webmailDashboard(w http.ResponseWriter, r *http.Request) {
 	mbox := mailboxFromContext(r)
 	passkeys, _ := a.DB.ListMailboxWebAuthnCredentials(mbox.ID)
@@ -33,6 +36,17 @@ func (a *App) webmailDashboard(w http.ResponseWriter, r *http.Request) {
 	})
 }
 
+// webmailMFASetupRequiredPage is the isolated, no-navigation landing page
+// requireMailboxAuth sends a mailbox owner to when enforce_mailbox_mfa applies and
+// they have no second factor yet — the only page (besides the totp/passkey setup
+// actions themselves) reachable until they set one up. Existing app passwords keep
+// authenticating IMAP/SMTP clients throughout — that's a separate, non-interactive
+// protocol path this gate has no bearing on.
+func (a *App) webmailMFASetupRequiredPage(w http.ResponseWriter, r *http.Request) {
+	mbox := mailboxFromContext(r)
+	a.render(w, r, "webmail_mfa_setup_required.html", M{"email": mbox.Email, "flashes": popFlashes(w, r)})
+}
+
 func (a *App) webmailChangePassword(w http.ResponseWriter, r *http.Request) {
 	mbox := mailboxFromContext(r)
 	current := r.FormValue("current_password")
@@ -106,6 +120,7 @@ func (a *App) webmailTOTPSetupConfirm(w http.ResponseWriter, r *http.Request) {
 		http.Redirect(w, r, MailboxPrefix+"/", http.StatusFound)
 		return
 	}
+	_ = a.DB.LogAuthAttempt("mailbox_mfa", mbox.Email, requestIP(r), true, "TOTP authenticator enabled")
 	setFlash(w, "success", "Authenticator app MFA enabled")
 	http.Redirect(w, r, MailboxPrefix+"/", http.StatusFound)
 }
@@ -115,6 +130,7 @@ func (a *App) webmailTOTPDisable(w http.ResponseWriter, r *http.Request) {
 	if err := a.DB.DisableMailboxTOTP(mbox.ID); err != nil {
 		setFlash(w, "error", "Something went wrong")
 	} else {
+		_ = a.DB.LogAuthAttempt("mailbox_mfa", mbox.Email, requestIP(r), true, "TOTP authenticator disabled")
 		setFlash(w, "success", "Authenticator app MFA disabled")
 	}
 	http.Redirect(w, r, MailboxPrefix+"/", http.StatusFound)