updated mailbox app password

internal/webui/flash.go

@@ -47,3 +47,44 @@ func popFlashes(w http.ResponseWriter, r *http.Request) []Flash {
 	}
 	return flashes
 }
+
+// AppPasswordReveal carries a freshly-generated app password secret across the
+// create->redirect hop, kept out of the toast-driven Flash system so it can render
+// as its own centered modal (with a copy button) instead of a toast that's easy to
+// miss and can't be copied without retyping.
+type AppPasswordReveal struct {
+	Label  string `json:"l"`
+	Secret string `json:"s"`
+}
+
+const appPasswordRevealCookieName = "app_pw_reveal"
+
+// setAppPasswordReveal mirrors setFlash but for the one-time secret reveal.
+func setAppPasswordReveal(w http.ResponseWriter, label, secret string) {
+	encoded, _ := json.Marshal(AppPasswordReveal{Label: label, Secret: secret})
+	http.SetCookie(w, &http.Cookie{
+		Name:     appPasswordRevealCookieName,
+		Value:    base64.URLEncoding.EncodeToString(encoded),
+		Path:     "/",
+		HttpOnly: true,
+		SameSite: http.SameSiteLaxMode,
+	})
+}
+
+// popAppPasswordReveal mirrors popFlashes but for the one-time secret reveal.
+func popAppPasswordReveal(w http.ResponseWriter, r *http.Request) *AppPasswordReveal {
+	c, err := r.Cookie(appPasswordRevealCookieName)
+	if err != nil || c.Value == "" {
+		return nil
+	}
+	http.SetCookie(w, &http.Cookie{Name: appPasswordRevealCookieName, Value: "", Path: "/", MaxAge: -1})
+	raw, err := base64.URLEncoding.DecodeString(c.Value)
+	if err != nil {
+		return nil
+	}
+	var reveal AppPasswordReveal
+	if err := json.Unmarshal(raw, &reveal); err != nil {
+		return nil
+	}
+	return &reveal
+}