added IMAP, LetsEncrypt, update layout

internal/db/mailbox_models.go

@@ -0,0 +1,108 @@
+package db
+
+import "time"
+
+// Mailbox is a real, IMAP-retrievable local mailbox — distinct from Sender (which is
+// relay/auth-only). PasswordHash authenticates the self-service web portal only;
+// IMAP/SMTP client login always goes through a MailboxAppPassword instead.
+type Mailbox struct {
+	ID           int64
+	Email        string
+	DomainID     int64
+	PasswordHash string
+	IsActive     bool
+	QuotaBytes   int64
+	UsedBytes    int64
+	DEKWrapped   []byte
+	DEKNonce     []byte
+	CreatedAt    time.Time
+	CreatedBy    *int64
+	TOTPSecret   string
+	TOTPEnabled  bool
+}
+
+// MailboxSession is a self-service webmail portal login — a parallel schema to
+// AdminSession, not shared (see esrv_mailbox_sessions in schema.go).
+type MailboxSession struct {
+	Token       string
+	MailboxID   int64
+	MFAVerified bool
+	CreatedAt   time.Time
+	ExpiresAt   time.Time
+}
+
+// MailboxWebAuthnCredential is a mailbox owner's passkey — a parallel schema to
+// WebAuthnCredential, not shared.
+type MailboxWebAuthnCredential struct {
+	ID             int64
+	MailboxID      int64
+	Name           string
+	CredentialID   string
+	CredentialData string
+	CreatedAt      time.Time
+}
+
+// MailboxAlias is an alternate address for a mailbox — receive-only by default, or
+// also usable as MAIL FROM once authenticated (CanSendAs). Login is always the
+// mailbox's own primary address, never an alias.
+type MailboxAlias struct {
+	ID        int64
+	MailboxID int64
+	Email     string
+	DomainID  int64
+	CanSendAs bool
+	IsActive  bool
+	CreatedAt time.Time
+}
+
+// MailboxAllowBlockEntry is one allow- or block-list pattern for a mailbox.
+type MailboxAllowBlockEntry struct {
+	ID        int64
+	MailboxID int64
+	ListType  string // "allow" | "block"
+	Pattern   string
+	CreatedAt time.Time
+}
+
+// MailboxFilterRule is one priority-ordered, first-match-wins delivery rule.
+type MailboxFilterRule struct {
+	ID             int64
+	MailboxID      int64
+	Priority       int
+	ConditionField string // "from" | "to" | "subject"
+	ConditionOp    string // "contains" | "equals" | "starts_with"
+	ConditionValue string
+	Action         string // "move_to_folder" | "delete" | "mark_read"
+	ActionValue    string
+	IsActive       bool
+	CreatedAt      time.Time
+}
+
+// MailboxAppPassword is the only credential an IMAP/SMTP client ever uses. Plaintext
+// is shown once at creation and never stored.
+type MailboxAppPassword struct {
+	ID           int64
+	MailboxID    int64
+	Label        string
+	PasswordHash string
+	IsActive     bool
+	CreatedAt    time.Time
+	LastUsedAt   *time.Time
+}
+
+// MailboxMessage is one stored message. CachedFrom/CachedSubject are plaintext by
+// design (see schema.go); the rest of the message lives encrypted at StoragePath.
+type MailboxMessage struct {
+	ID              int64
+	MailboxID       int64
+	Folder          string
+	MessageIDHeader string
+	Flags           string
+	InternalDate    time.Time
+	SizeBytes       int64
+	CachedFrom      string
+	CachedSubject   string
+	StoragePath     string
+	Nonce           []byte
+	CreatedAt       time.Time
+}